@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-access-block.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAD3B,OAAO,eAEH;IAEJ;;OAEG;IACH,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAO3C;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,mCAAmC,GACjD,sBAAsB,CAOxB;IAED;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,eAAe,IAAI,8BAA8B,CAEhD;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.js

@@ -0,0 +1,57 @@
+/**
+ * The S3 Block Public Access settings of one simulated Bucket.
+ *
+ * There are two distinct states here and they are not the same. A Bucket nobody
+ * has configured blocks everything, which is what real S3 does for every new
+ * Bucket. A Bucket someone has configured has exactly what they asked for: the
+ * configuration replaces the previous one wholesale, so a setting left out of
+ * it is off rather than inherited.
+ *
+ * That second rule matters more than it looks. CDK's `BlockPublicAccess.
+ * BLOCK_ACLS` sets only `blockPublicAcls` and `ignorePublicAcls`, leaving
+ * `BlockPublicPolicy` out of the synthesized template, and pairing it with
+ * `publicReadAccess` is the standard way to build a public website Bucket.
+ * Treating the omitted setting as enabled would refuse that template, which
+ * real AWS deploys without complaint.
+ */
+export class SimS3PublicAccessBlock {
+    settings;
+    constructor(settings) {
+        this.settings = settings;
+    }
+    /**
+     * The all-blocked state a Bucket has until something configures it.
+     */
+    static blockingAll() {
+        return new SimS3PublicAccessBlock({
+            BlockPublicAcls: true,
+            IgnorePublicAcls: true,
+            BlockPublicPolicy: true,
+            RestrictPublicBuckets: true,
+        });
+    }
+    /**
+     * A configuration exactly as supplied, with anything omitted turned off.
+     */
+    static fromConfiguration(configuration) {
+        return new SimS3PublicAccessBlock({
+            BlockPublicAcls: configuration.BlockPublicAcls ?? false,
+            IgnorePublicAcls: configuration.IgnorePublicAcls ?? false,
+            BlockPublicPolicy: configuration.BlockPublicPolicy ?? false,
+            RestrictPublicBuckets: configuration.RestrictPublicBuckets ?? false,
+        });
+    }
+    /**
+     * Whether this Bucket refuses a Bucket policy that allows public access.
+     */
+    blocksPublicPolicy() {
+        return this.settings.BlockPublicPolicy;
+    }
+    /**
+     * The configuration as an AWS-shaped record, for GetPublicAccessBlock.
+     */
+    toConfiguration() {
+        return { ...this.settings };
+    }
+}
+//# sourceMappingURL=sim-s3-public-access-block.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-access-block.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,sBAAsB;IAEd,QAAQ;IAD3B,YACmB,QAAwC;wBAAxC,QAAQ;IACxB,CAAC;IAEJ;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,sBAAsB,CAAC;YAChC,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;YACvB,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAkD;QAElD,OAAO,IAAI,sBAAsB,CAAC;YAChC,eAAe,EAAE,aAAa,CAAC,eAAe,IAAI,KAAK;YACvD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,IAAI,KAAK;YACzD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,KAAK;YAC3D,qBAAqB,EAAE,aAAa,CAAC,qBAAqB,IAAI,KAAK;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.d.ts

@@ -0,0 +1,19 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+import type { SimS3Bucket } from "../sim-s3-bucket.js";
+/**
+ * Refuses a Bucket policy that the Bucket's Block Public Access settings do
+ * not allow.
+ *
+ * Real S3 applies this after deciding the caller may set a policy at all, so
+ * it refuses a policy the caller is otherwise entitled to apply. Enabling the
+ * setting later does not disturb a policy already stored: it governs what may
+ * be written, not what is already there.
+ */
+export declare class SimS3PublicPolicyGuard {
+    private readonly publicPolicy;
+    /**
+     * Throw when the Bucket blocks public policies and this document is one.
+     */
+    guard(bucket: SimS3Bucket, document: SimIamPolicyDocument): void;
+}
+//# sourceMappingURL=sim-s3-public-policy-guard.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy-guard.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IAExD;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAa/D;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.js

@@ -0,0 +1,28 @@
+import { SimS3AccessDenied } from "../../error/sim-s3.error.js";
+import { SimS3PublicPolicy } from "./sim-s3-public-policy.js";
+/**
+ * Refuses a Bucket policy that the Bucket's Block Public Access settings do
+ * not allow.
+ *
+ * Real S3 applies this after deciding the caller may set a policy at all, so
+ * it refuses a policy the caller is otherwise entitled to apply. Enabling the
+ * setting later does not disturb a policy already stored: it governs what may
+ * be written, not what is already there.
+ */
+export class SimS3PublicPolicyGuard {
+    publicPolicy = new SimS3PublicPolicy();
+    /**
+     * Throw when the Bucket blocks public policies and this document is one.
+     */
+    guard(bucket, document) {
+        if (!bucket.getPublicAccessBlock().blocksPublicPolicy()) {
+            return;
+        }
+        if (!this.publicPolicy.isPublic(document)) {
+            return;
+        }
+        throw new SimS3AccessDenied(`BlockPublicPolicy is enabled on S3 Bucket ${bucket.bucketName}, ` +
+            "so a Bucket policy allowing public access is refused");
+    }
+}
+//# sourceMappingURL=sim-s3-public-policy-guard.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy-guard.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,YAAY,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAExD;;OAEG;IACH,KAAK,CAAC,MAAmB,EAAE,QAA8B;QACvD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,MAAM,CAAC,UAAU,IAAI;YAChE,sDAAsD,CACzD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.d.ts

@@ -0,0 +1,18 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * Decides whether a Bucket policy allows public access, which is what S3 Block
+ * Public Access judges a PutBucketPolicy call against.
+ *
+ * Real S3 starts by assuming a policy is public and looks for a reason it is
+ * not: a statement qualifies as non-public only when it grants access to fixed
+ * values. The simulator follows the same direction, so anything it cannot
+ * classify stays public and gets refused.
+ */
+export declare class SimS3PublicPolicy {
+    /**
+     * Whether any statement in the document grants public access.
+     */
+    isPublic(document: SimIamPolicyDocument): boolean;
+    private statementIsPublic;
+}
+//# sourceMappingURL=sim-s3-public-policy.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,uCAAuC,CAAC;AAI/C;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAIhD;IAED,OAAO,CAAC,iBAAiB;CAiB1B"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.js

@@ -0,0 +1,35 @@
+import { simIamPolicyDocumentStatements } from "../../../iam/policy/sim-iam-pol-document-statements.js";
+import { simS3ConditionPinsPrincipal } from "./sim-s3-pinning-condition.js";
+import { simS3PrincipalIsWildcard } from "./sim-s3-public-principal.js";
+/**
+ * Decides whether a Bucket policy allows public access, which is what S3 Block
+ * Public Access judges a PutBucketPolicy call against.
+ *
+ * Real S3 starts by assuming a policy is public and looks for a reason it is
+ * not: a statement qualifies as non-public only when it grants access to fixed
+ * values. The simulator follows the same direction, so anything it cannot
+ * classify stays public and gets refused.
+ */
+export class SimS3PublicPolicy {
+    /**
+     * Whether any statement in the document grants public access.
+     */
+    isPublic(document) {
+        return simIamPolicyDocumentStatements(document).some((statement) => this.statementIsPublic(statement));
+    }
+    statementIsPublic(statement) {
+        if (statement.Effect !== "Allow") {
+            return false;
+        }
+        // NotPrincipal grants to everyone except the listed identities, which is
+        // public by any reading.
+        if (statement.NotPrincipal !== undefined) {
+            return true;
+        }
+        if (!simS3PrincipalIsWildcard(statement.Principal)) {
+            return false;
+        }
+        return !simS3ConditionPinsPrincipal(statement.Condition);
+    }
+}
+//# sourceMappingURL=sim-s3-public-policy.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AAKxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAA8B;QACrC,OAAO,8BAA8B,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAClC,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,SAAwC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,2BAA2B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.d.ts

@@ -0,0 +1,11 @@
+import type { SimIamPolicyDocumentPrincipal } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * Whether a policy statement Principal names everyone rather than fixed
+ * identities.
+ *
+ * Only the `AWS` principal type can be a wildcard that opens a Bucket to the
+ * world. A `Service`, `Federated` or `CanonicalUser` principal names something
+ * specific, so a statement granting one of those is not public.
+ */
+export declare function simS3PrincipalIsWildcard(principal: SimIamPolicyDocumentPrincipal | undefined): boolean;
+//# sourceMappingURL=sim-s3-public-principal.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-principal.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,6BAA6B,GAAG,SAAS,GACnD,OAAO,CAkBT"}

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.js

@@ -0,0 +1,34 @@
+/**
+ * Whether a policy statement Principal names everyone rather than fixed
+ * identities.
+ *
+ * Only the `AWS` principal type can be a wildcard that opens a Bucket to the
+ * world. A `Service`, `Federated` or `CanonicalUser` principal names something
+ * specific, so a statement granting one of those is not public.
+ */
+export function simS3PrincipalIsWildcard(principal) {
+    if (principal === undefined) {
+        // A Bucket policy statement must name a Principal. One that does not is
+        // not something the simulator can classify, so it counts as public.
+        return true;
+    }
+    if (typeof principal === "string") {
+        return principal === "*";
+    }
+    if (Array.isArray(principal)) {
+        return principal.includes("*");
+    }
+    return awsPrincipalIsWildcard(principal);
+}
+function awsPrincipalIsWildcard(principal) {
+    for (const [principalType, value] of Object.entries(principal)) {
+        if (principalType.toLowerCase() !== "aws") {
+            continue;
+        }
+        if (typeof value === "string" ? value === "*" : value.includes("*")) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sim-s3-public-principal.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-principal.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-principal.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoD;IAEpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,KAAK,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,sBAAsB,CAC3B,SAAgD,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8C;IAE9C,KAAK,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/s3/bucket/sim-s3-bucket-arn.d.ts

@@ -0,0 +1,9 @@
+import type { SimS3BucketName } from "./sim-s3-bucket.js";
+/**
+ * The ARN of a simulated S3 Bucket.
+ *
+ * S3 Bucket ARNs name no Account and no Region, because Bucket names are
+ * globally unique in S3. Object ARNs are this with `/<key>` appended.
+ */
+export declare function simS3BucketArn(bucketName: SimS3BucketName | string): string;
+//# sourceMappingURL=sim-s3-bucket-arn.d.ts.map

package/dist/service/s3/bucket/sim-s3-bucket-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAE3E"}

package/dist/service/s3/bucket/sim-s3-bucket-arn.js

@@ -0,0 +1,10 @@
+/**
+ * The ARN of a simulated S3 Bucket.
+ *
+ * S3 Bucket ARNs name no Account and no Region, because Bucket names are
+ * globally unique in S3. Object ARNs are this with `/<key>` appended.
+ */
+export function simS3BucketArn(bucketName) {
+    return `arn:aws:s3:::${bucketName}`;
+}
+//# sourceMappingURL=sim-s3-bucket-arn.js.map

package/dist/service/s3/bucket/sim-s3-bucket-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-arn.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket-arn.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAoC;IACjE,OAAO,gBAAgB,UAAU,EAAE,CAAC;AACtC,CAAC"}

package/dist/service/s3/bucket/sim-s3-bucket.d.ts

@@ -2,6 +2,7 @@ import type { Brand } from "../../../util/brand.type.js";
 import type { SimS3BucketStorage } from "../storage/s3-bucket-storage.js";
 import type { SimS3Object } from "../object/s3-object.js";
 import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
 export type SimS3BucketName = Brand<string, "SimS3BucketName">;
@@ -11,6 +12,7 @@ interface SimS3BucketProperties {
     readonly storage?: SimS3BucketStorage;
     readonly website?: SimS3BucketWebsite;
     readonly policy?: SimIamPolicyDocument | undefined;
+    readonly publicAccessBlock?: SimS3PublicAccessBlock;
 }
 /**
  * Simulated S3 Bucket.
@@ -21,6 +23,7 @@ export declare class SimS3Bucket {
     private storage;
     private website;
     private policy;
+    private publicAccessBlock;
     constructor(properties: SimS3BucketProperties);
     /**
      * Put a simulated S3 Object into storage.
@@ -54,6 +57,28 @@ export declare class SimS3Bucket {
      * Get the Bucket resource policy.
      */
     getPolicy(): SimIamPolicyDocument | undefined;
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy(): void;
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock: SimS3PublicAccessBlock): void;
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock(): SimS3PublicAccessBlock;
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock(): void;
     /**
      * Get the simulated AWS account Region scope for this Bucket.
      */

package/dist/service/s3/bucket/sim-s3-bucket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-bucket.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAK/E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE/D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACpD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,SAAgB,UAAU,EAAE,eAAe,CAAC;IAE5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAmC;IAEjD,YAAY,UAAU,EAAE,qBAAqB,EAgB5C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAED;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7D;IAED;;OAEG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEzD;IAED;;OAEG;IACH,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAErD;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,UAAU,IAAI,kBAAkB,CAE/B;IAED;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAE5C;IAED;;OAEG;IACH,qBAAqB,IAAI,wBAAwB,CAEhD;IAED;;OAEG;IACH,aAAa,IAAI,GAAG,CAMnB;CACF"}
+{"version":3,"file":"sim-s3-bucket.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAK/E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE/D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,SAAgB,UAAU,EAAE,eAAe,CAAC;IAE5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,iBAAiB,CAAyB;IAElD,YAAY,UAAU,EAAE,qBAAqB,EAkB5C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAED;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7D;IAED;;OAEG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEzD;IAED;;OAEG;IACH,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAErD;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,UAAU,IAAI,kBAAkB,CAE/B;IAED;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAE5C;IAED;;;;;OAKG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,0BAA0B,CAAC,iBAAiB,EAAE,sBAAsB,GAAG,IAAI,CAE1E;IAED;;OAEG;IACH,oBAAoB,IAAI,sBAAsB,CAE7C;IAED;;;;;OAKG;IACH,uBAAuB,IAAI,IAAI,CAE9B;IAED;;OAEG;IACH,qBAAqB,IAAI,wBAAwB,CAEhD;IAED;;OAEG;IACH,aAAa,IAAI,GAAG,CAMnB;CACF"}

package/dist/service/s3/bucket/sim-s3-bucket.js

@@ -1,5 +1,6 @@
 import { MemoryS3BucketStorage } from "../storage/s3-memory-storage.js";
 import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
 import { simS3BucketWebsiteUrl } from "./website/sim-s3-bucket-website-url.js";
 import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
 import { simAwsAccountRegionScopeFactory } from "../../aws/sim-aws-account-region-scope.factory.js";
@@ -12,14 +13,16 @@ export class SimS3Bucket {
     storage;
     website;
     policy;
+    publicAccessBlock;
     constructor(properties) {
-        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, } = properties;
+        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, publicAccessBlock = SimS3PublicAccessBlock.blockingAll(), } = properties;
         validateS3BucketName(bucketName);
         this.bucketName = bucketName;
         this.accountRegionScope = accountRegionScope;
         this.storage = storage;
         this.website = website;
         this.policy = policy;
+        this.publicAccessBlock = publicAccessBlock;
     }
     /**
      * Put a simulated S3 Object into storage.
@@ -69,6 +72,36 @@ export class SimS3Bucket {
     getPolicy() {
         return this.policy;
     }
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy() {
+        this.policy = undefined;
+    }
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock) {
+        this.publicAccessBlock = publicAccessBlock;
+    }
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock() {
+        return this.publicAccessBlock;
+    }
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock() {
+        this.publicAccessBlock = SimS3PublicAccessBlock.blockingAll();
+    }
     /**
      * Get the simulated AWS account Region scope for this Bucket.
      */

package/dist/service/s3/bucket/sim-s3-bucket.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-bucket.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAYpG;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,UAAU,CAAkB;IAE3B,kBAAkB,CAA2B;IACtD,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,MAAM,CAAmC;IAEjD,YAAY,UAAiC;QAC3C,MAAM,EACJ,UAAU,EACV,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,OAAO,GAAG,IAAI,qBAAqB,EAAE,EACrC,OAAO,GAAG,IAAI,kBAAkB,EAAE,EAClC,MAAM,GACP,GAAG,UAAU,CAAC;QAEf,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,OAA2B;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAA2B;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAA4B;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,qBAAqB,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-s3-bucket.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAGvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAapG;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,UAAU,CAAkB;IAE3B,kBAAkB,CAA2B;IACtD,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,MAAM,CAAmC;IACzC,iBAAiB,CAAyB;IAElD,YAAY,UAAiC;QAC3C,MAAM,EACJ,UAAU,EACV,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,OAAO,GAAG,IAAI,qBAAqB,EAAE,EACrC,OAAO,GAAG,IAAI,kBAAkB,EAAE,EAClC,MAAM,EACN,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,EAAE,GACzD,GAAG,UAAU,CAAC;QAEf,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,OAA2B;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAA2B;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAA4B;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,0BAA0B,CAAC,iBAAyC;QAClE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,uBAAuB;QACrB,IAAI,CAAC,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,qBAAqB,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/bucket/sim-s3-endpoint-url.d.ts

@@ -0,0 +1,16 @@
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import type { SimS3BucketName } from "./sim-s3-bucket.js";
+/**
+ * The simulated S3 REST API endpoint for a Region.
+ *
+ * This is the URL an AWS SDK client is pointed at, and the client adds the
+ * Bucket to it for itself, as it does against real S3. Handing out the service
+ * endpoint rather than a Bucket one is therefore what lets the real SDK, and
+ * the real presigner, build simulated S3 URLs without being told how.
+ */
+export declare function simS3ServiceUrl(regionName: AwsRegionName): URL;
+/**
+ * The simulated S3 REST API endpoint for one Bucket, in virtual-hosted style.
+ */
+export declare function simS3BucketUrl(bucketName: SimS3BucketName, regionName: AwsRegionName): URL;
+//# sourceMappingURL=sim-s3-endpoint-url.d.ts.map

package/dist/service/s3/bucket/sim-s3-endpoint-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-endpoint-url.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-endpoint-url.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,GAAG,CAE9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,eAAe,EAC3B,UAAU,EAAE,aAAa,GACxB,GAAG,CAIL"}

package/dist/service/s3/bucket/sim-s3-endpoint-url.js

@@ -0,0 +1,19 @@
+import { simAwsLocalConfig } from "../../../serve/http/local-server/sim-aws-local.config.js";
+/**
+ * The simulated S3 REST API endpoint for a Region.
+ *
+ * This is the URL an AWS SDK client is pointed at, and the client adds the
+ * Bucket to it for itself, as it does against real S3. Handing out the service
+ * endpoint rather than a Bucket one is therefore what lets the real SDK, and
+ * the real presigner, build simulated S3 URLs without being told how.
+ */
+export function simS3ServiceUrl(regionName) {
+    return new URL(`http://s3.${regionName}.${simAwsLocalConfig.hostname}/`);
+}
+/**
+ * The simulated S3 REST API endpoint for one Bucket, in virtual-hosted style.
+ */
+export function simS3BucketUrl(bucketName, regionName) {
+    return new URL(`http://${bucketName}.s3.${regionName}.${simAwsLocalConfig.hostname}/`);
+}
+//# sourceMappingURL=sim-s3-endpoint-url.js.map

package/dist/service/s3/bucket/sim-s3-endpoint-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-endpoint-url.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-endpoint-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAI7F;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB;IACvD,OAAO,IAAI,GAAG,CAAC,aAAa,UAAU,IAAI,iBAAiB,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAC3B,UAAyB;IAEzB,OAAO,IAAI,GAAG,CACZ,UAAU,UAAU,OAAO,UAAU,IAAI,iBAAiB,CAAC,QAAQ,GAAG,CACvE,CAAC;AACJ,CAAC"}

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.d.ts

@@ -0,0 +1,13 @@
+import type { SimS3 } from "../../sim-s3.js";
+/**
+ * Make a Bucket's Objects publicly readable, as a static website Bucket must
+ * be.
+ *
+ * Real S3 serves a website endpoint only what the Bucket policy has made
+ * readable, and blocks a public Bucket policy on a new Bucket, so a website
+ * needs both steps. This issues exactly the two commands a real deployment
+ * issues rather than reaching around them, so a test using it exercises the
+ * same path a user's own setup would.
+ */
+export declare function grantPublicWebsiteRead(simS3: SimS3, bucketName: string): Promise<void>;
+//# sourceMappingURL=sim-s3-public-website.fixture.d.ts.map

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-website.fixture.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/website/sim-s3-public-website.fixture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.js

@@ -0,0 +1,36 @@
+/**
+ * Make a Bucket's Objects publicly readable, as a static website Bucket must
+ * be.
+ *
+ * Real S3 serves a website endpoint only what the Bucket policy has made
+ * readable, and blocks a public Bucket policy on a new Bucket, so a website
+ * needs both steps. This issues exactly the two commands a real deployment
+ * issues rather than reaching around them, so a test using it exercises the
+ * same path a user's own setup would.
+ */
+export async function grantPublicWebsiteRead(simS3, bucketName) {
+    await simS3.putPublicAccessBlock({
+        input: {
+            Bucket: bucketName,
+            PublicAccessBlockConfiguration: {
+                BlockPublicAcls: true,
+                IgnorePublicAcls: true,
+            },
+        },
+    });
+    await simS3.putBucketPolicy({
+        input: {
+            Bucket: bucketName,
+            Policy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: {
+                    Effect: "Allow",
+                    Principal: "*",
+                    Action: "s3:GetObject",
+                    Resource: `arn:aws:s3:::${bucketName}/*`,
+                },
+            }),
+        },
+    });
+}
+//# sourceMappingURL=sim-s3-public-website.fixture.js.map

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-website.fixture.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/website/sim-s3-public-website.fixture.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,UAAkB;IAElB,MAAM,KAAK,CAAC,oBAAoB,CAAC;QAC/B,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,8BAA8B,EAAE;gBAC9B,eAAe,EAAE,IAAI;gBACrB,gBAAgB,EAAE,IAAI;aACvB;SACF;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,GAAG;oBACd,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,gBAAgB,UAAU,IAAI;iBACzC;aACF,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.d.ts

@@ -0,0 +1,27 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3 } from "../../sim-s3.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface SimCfnS3BucketCreatorProperties {
+    readonly simS3: SimS3;
+}
+/**
+ * Creates simulated S3 Buckets from AWS::S3::Bucket CloudFormation Resources.
+ */
+export declare class SimCfnS3BucketCreator {
+    private readonly simS3;
+    constructor(properties: SimCfnS3BucketCreatorProperties);
+    /**
+     * Create a simulated Bucket, with its website configuration when declared.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimS3Bucket>;
+    /**
+     * Read PublicAccessBlockConfiguration, which a template uses to open a
+     * Bucket up from the all-blocked state a new Bucket starts in.
+     */
+    private publicAccessConfigurationForResource;
+    private bucketNameForResource;
+    private websiteConfigurationForResource;
+}
+export {};
+//# sourceMappingURL=sim-cfn-s3-bucket-creator.d.ts.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAMjE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,WAAW,CAAC,CAwCtB;IAED;;;OAGG;IACH,OAAO,CAAC,oCAAoC;IAiB5C,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,+BAA+B;CAqCxC"}