@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js

@@ -1,3 +1,5 @@
+import { SimIamSigV4PayloadDeclaration } from "./canonical/sim-iam-sigv4-payload-hash.js";
+import { SimIamSigV4PresignedQuery } from "./presign/sim-iam-sigv4-presigned-query.js";
 import { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
 import { simIamSigV4CheckExpectedScope } from "./sim-iam-sigv4-expected-scope.js";
 import { simIamSigV4CheckSignature } from "./sim-iam-sigv4-signature-check.js";
@@ -10,10 +12,16 @@ import { simIamSigV4SigningCredential } from "./sim-iam-sigv4-signing-credential
  * principal made the request, which is exactly the question the IAM
  * authorization already built has no way to ask of an HTTP request.
  *
- * Verification needs no clock. The signing date is an input to the signing key
- * and comes from the request, so a correctly signed request verifies whenever
- * it arrives. Only the credentials behind it can go stale, and that is judged in
- * simulated time by the registry.
+ * A signature arrives in one of two forms, an `Authorization` header or the
+ * query string of a presigned URL, and both are verified here. The work either
+ * way is the same canonical request against the same signing key; only where
+ * the claims are read from, and whether a lifetime is stated, differ.
+ *
+ * Verifying a header-signed request needs no clock. The signing date is an
+ * input to the signing key and comes from the request, so a correctly signed
+ * request verifies whenever it arrives. Only the credentials behind it can go
+ * stale, and that is judged in simulated time by the registry. A presigned URL
+ * is the exception, because it states its own expiry.
  */
 export class SimIamSigV4Verifier {
     credentials;
@@ -27,19 +35,57 @@ export class SimIamSigV4Verifier {
      * with when the request cannot be attributed to a registered access key.
      */
     verify(signedRequest, options = {}) {
+        if (SimIamSigV4PresignedQuery.carriedBy(signedRequest.url)) {
+            return this.verifyPresigned(signedRequest, options);
+        }
+        return this.verifyHeaderSigned(signedRequest, options);
+    }
+    verifyHeaderSigned(signedRequest, options) {
         const authorization = SimIamSigV4Authorization.parse(signedRequest.headers.get("authorization"));
         // Checked before anything else can fail on it, so a signature made for the
         // wrong endpoint says so rather than looking like a bad secret.
         simIamSigV4CheckExpectedScope(options.expectedScope, authorization.scope);
         const amzDate = simIamSigV4RequestDate(signedRequest.headers, authorization.scope);
-        const { signingKey, identity } = simIamSigV4SigningCredential(this.credentials, signedRequest, authorization, options.now);
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: authorization,
+            sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
+            now: options.now,
+        });
         simIamSigV4CheckSignature({
             signedRequest,
-            authorization,
+            statement: authorization,
             signingKey,
             amzDate,
         });
         return identity;
     }
+    /**
+     * Verify a presigned URL.
+     *
+     * Expiry is checked before the signature, because an expired URL is the
+     * likeliest reason a presigned request fails and "this expired" is a far
+     * more useful thing to be told than "this signature does not match". The
+     * expiry is signed, so a URL cannot claim a longer life than it was given.
+     */
+    verifyPresigned(signedRequest, options) {
+        const presigned = SimIamSigV4PresignedQuery.parse(signedRequest.url);
+        simIamSigV4CheckExpectedScope(options.expectedScope, presigned.scope);
+        presigned.checkNotExpired(options.now ?? new Date());
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: presigned,
+            sessionToken: presigned.sessionToken,
+            now: options.now,
+        });
+        simIamSigV4CheckSignature({
+            signedRequest,
+            statement: presigned,
+            signingKey,
+            amzDate: presigned.amzDate,
+            payload: SimIamSigV4PayloadDeclaration.fromPresignedQuery(signedRequest.url),
+        });
+        return identity;
+    }
 }
 //# sourceMappingURL=sim-iam-sigv4-verifier.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAC3D,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,aAAa,EACb,OAAO,CAAC,GAAG,CACZ,CAAC;QAEF,yBAAyB,CAAC;YACxB,aAAa;YACb,aAAa;YACb,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,IAAI,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,kBAAkB,CACxB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,aAAa;YACxB,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;YAChE,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CACrB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAErE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACtE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,SAAS;YACpB,UAAU;YACV,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,OAAO,EAAE,6BAA6B,CAAC,kBAAkB,CACvD,aAAa,CAAC,GAAG,CAClB;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.d.ts

@@ -0,0 +1,25 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimKmsAlias } from "../../key/sim-kms-alias.js";
+import type { SimKms } from "../../sim-kms.js";
+interface SimCfnKmsAliasCreatorProperties {
+    readonly kms: SimKms;
+}
+/**
+ * Creates simulated KMS aliases from AWS::KMS::Alias Resources.
+ *
+ * The alias goes through the ordinary CreateAlias command, so a template gets
+ * the same name validation an SDK caller would: the `alias/` prefix is
+ * required, the `alias/aws/` prefix is reserved, and a name already in use is
+ * refused.
+ */
+export declare class SimCfnKmsAliasCreator {
+    private readonly kms;
+    constructor(properties: SimCfnKmsAliasCreatorProperties);
+    /**
+     * Create an alias from an AWS::KMS::Alias Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsAlias>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-alias-creator.d.ts.map

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-alias-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/alias/sim-cfn-kms-alias-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,UAAU,+BAA+B;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,WAAW,CAAC,CAqBtB;CACF"}

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.js

@@ -0,0 +1,36 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnKmsAliasProperties } from "./sim-cfn-kms-alias-properties.js";
+/**
+ * Creates simulated KMS aliases from AWS::KMS::Alias Resources.
+ *
+ * The alias goes through the ordinary CreateAlias command, so a template gets
+ * the same name validation an SDK caller would: the `alias/` prefix is
+ * required, the `alias/aws/` prefix is reserved, and a name already in use is
+ * refused.
+ */
+export class SimCfnKmsAliasCreator {
+    kms;
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Create an alias from an AWS::KMS::Alias Resource.
+     */
+    async create(resource, properties) {
+        const aliasProperties = new SimCfnKmsAliasProperties({
+            resource,
+            properties,
+        });
+        const aliasName = aliasProperties.aliasName();
+        await this.kms.createAlias({
+            input: {
+                AliasName: aliasName,
+                TargetKeyId: aliasProperties.targetKeyId(),
+            },
+        });
+        const alias = this.kms.findAlias(aliasName);
+        assertDefined(alias, `sim KMS alias ${aliasName} after CloudFormation creation`);
+        return alias;
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-alias-creator.js.map

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-alias-creator.js","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/alias/sim-cfn-kms-alias-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAM7E;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,GAAG,CAAS;IAE7B,YAAY,UAA2C;QACrD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,eAAe,GAAG,IAAI,wBAAwB,CAAC;YACnD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC;QAE9C,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACzB,KAAK,EAAE;gBACL,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,eAAe,CAAC,WAAW,EAAE;aAC3C;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,aAAa,CACX,KAAK,EACL,iBAAiB,SAAS,gCAAgC,CAC3D,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-properties.d.ts

@@ -0,0 +1,32 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnKmsAliasPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Reads AWS::KMS::Alias CloudFormation properties into the shape the alias
+ * creator needs.
+ *
+ * Both properties are required, as they are on real CloudFormation: an alias
+ * with no name names nothing, and an alias with no target points at nothing.
+ */
+export declare class SimCfnKmsAliasProperties {
+    private readonly resource;
+    private readonly properties;
+    private readonly propertyParser;
+    constructor(properties: SimCfnKmsAliasPropertiesProperties);
+    /**
+     * The alias name, including its `alias/` prefix.
+     */
+    aliasName(): string;
+    /**
+     * The key the alias points at, in any of the forms KMS accepts as a KeyId.
+     *
+     * A template usually gets here through `!Ref` on its AWS::KMS::Key, which
+     * resolves to that key's key ID.
+     */
+    targetKeyId(): string;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-alias-properties.d.ts.map

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-alias-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/alias/sim-cfn-kms-alias-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAGlH,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE5B;IAEH,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;OAEG;IACH,SAAS,IAAI,MAAM,CAMlB;IAED;;;;;OAKG;IACH,WAAW,IAAI,MAAM,CAMpB;CACF"}

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-properties.js

@@ -0,0 +1,35 @@
+import { SimCfnKmsPropertyParser } from "../sim-cfn-kms-property-parser.js";
+/**
+ * Reads AWS::KMS::Alias CloudFormation properties into the shape the alias
+ * creator needs.
+ *
+ * Both properties are required, as they are on real CloudFormation: an alias
+ * with no name names nothing, and an alias with no target points at nothing.
+ */
+export class SimCfnKmsAliasProperties {
+    resource;
+    properties;
+    propertyParser = new SimCfnKmsPropertyParser({
+        resourceType: "AWS::KMS::Alias",
+    });
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * The alias name, including its `alias/` prefix.
+     */
+    aliasName() {
+        return this.propertyParser.requiredString(this.resource, this.properties["AliasName"], "AliasName");
+    }
+    /**
+     * The key the alias points at, in any of the forms KMS accepts as a KeyId.
+     *
+     * A template usually gets here through `!Ref` on its AWS::KMS::Key, which
+     * resolves to that key's key ID.
+     */
+    targetKeyId() {
+        return this.propertyParser.requiredString(this.resource, this.properties["TargetKeyId"], "TargetKeyId");
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-alias-properties.js.map

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-alias-properties.js","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/alias/sim-cfn-kms-alias-properties.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAO5E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IACtC,cAAc,GAAG,IAAI,uBAAuB,CAAC;QAC5D,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IAEH,YAAY,UAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CACvC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAC5B,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CACvC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAC9B,aAAa,CACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.d.ts

@@ -0,0 +1,36 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+import type { SimKms } from "../../sim-kms.js";
+interface SimCfnKmsKeyCreatorProperties {
+    readonly kms: SimKms;
+}
+/**
+ * Creates simulated KMS keys from AWS::KMS::Key Resources.
+ *
+ * The key is created through the ordinary CreateKey command rather than
+ * constructed directly, so a key a template deployed is the same thing an SDK
+ * caller would have got: real key material, the same key policy handling, and
+ * the same refusal of key types this simulation does not model.
+ */
+export declare class SimCfnKmsKeyCreator {
+    private readonly kms;
+    constructor(properties: SimCfnKmsKeyCreatorProperties);
+    /**
+     * Create a key from an AWS::KMS::Key Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsKey>;
+    /**
+     * Apply `Enabled: false`, which asks for a key that is disabled the moment
+     * it exists.
+     *
+     * CreateKey has no input for that, as the real API has none either: real
+     * CloudFormation makes the key and then disables it. The key model is
+     * disabled directly rather than through DisableKey, because CloudFormation
+     * is acting as the key's creator here and has no caller identity of its own
+     * to authorize.
+     */
+    private applyEnabled;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-key-creator.d.ts.map

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-key-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-key-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,UAAU,6BAA6B;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CAyBpB;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;CAKrB"}

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.js

@@ -0,0 +1,53 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnKmsKeyProperties } from "./sim-cfn-kms-key-properties.js";
+/**
+ * Creates simulated KMS keys from AWS::KMS::Key Resources.
+ *
+ * The key is created through the ordinary CreateKey command rather than
+ * constructed directly, so a key a template deployed is the same thing an SDK
+ * caller would have got: real key material, the same key policy handling, and
+ * the same refusal of key types this simulation does not model.
+ */
+export class SimCfnKmsKeyCreator {
+    kms;
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Create a key from an AWS::KMS::Key Resource.
+     */
+    async create(resource, properties) {
+        const keyProperties = new SimCfnKmsKeyProperties({ resource, properties });
+        const created = await this.kms.createKey({
+            input: {
+                Description: keyProperties.description(),
+                Policy: keyProperties.policy(),
+                KeySpec: keyProperties.keySpec(),
+                KeyUsage: keyProperties.keyUsage(),
+                Origin: keyProperties.origin(),
+            },
+        });
+        const keyId = created.KeyMetadata?.KeyId;
+        assertDefined(keyId, `sim KMS key ID after CloudFormation creation for ${resource.logicalId}`);
+        const key = this.kms.findKey(keyId);
+        assertDefined(key, `sim KMS key ${keyId} after CloudFormation creation`);
+        this.applyEnabled(key, keyProperties.enabled());
+        return key;
+    }
+    /**
+     * Apply `Enabled: false`, which asks for a key that is disabled the moment
+     * it exists.
+     *
+     * CreateKey has no input for that, as the real API has none either: real
+     * CloudFormation makes the key and then disables it. The key model is
+     * disabled directly rather than through DisableKey, because CloudFormation
+     * is acting as the key's creator here and has no caller identity of its own
+     * to authorize.
+     */
+    applyEnabled(key, enabled) {
+        if (!enabled) {
+            key.disable();
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-key-creator.js.map

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-key-creator.js","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-key-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAMzE;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACb,GAAG,CAAS;IAE7B,YAAY,UAAyC;QACnD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,aAAa,GAAG,IAAI,sBAAsB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACvC,KAAK,EAAE;gBACL,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;gBAC9B,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE;gBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;gBAClC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;QACzC,aAAa,CACX,KAAK,EACL,oDAAoD,QAAQ,CAAC,SAAS,EAAE,CACzE,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,aAAa,CAAC,GAAG,EAAE,eAAe,KAAK,gCAAgC,CAAC,CAAC;QAEzE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY,CAAC,GAAc,EAAE,OAAgB;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/cfn/key/sim-cfn-kms-key-properties.d.ts

@@ -0,0 +1,57 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnKmsKeyPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Reads AWS::KMS::Key CloudFormation properties into the shape the key creator
+ * needs.
+ *
+ * Keeping the property-shape rules here leaves the creator to do nothing but
+ * call CreateKey, and puts the refusals for unmodelled key behaviour in one
+ * place beside the properties they belong to.
+ *
+ * Those refusals run on construction rather than when a property is read, so
+ * a Resource asking for something unmodelled cannot get as far as creating a
+ * key that would then be wrong.
+ */
+export declare class SimCfnKmsKeyProperties {
+    private readonly resource;
+    private readonly properties;
+    private readonly propertyParser;
+    constructor(properties: SimCfnKmsKeyPropertiesProperties);
+    /**
+     * The key Description.
+     */
+    description(): string | undefined;
+    /**
+     * The key policy, as the JSON document string CreateKey takes.
+     *
+     * Omitting it gets the default root-delegation policy KMS applies, which is
+     * the same thing CreateKey does with no Policy.
+     */
+    policy(): string | undefined;
+    /**
+     * The requested key spec, passed through so CreateKey refuses the specs this
+     * simulation does not create.
+     */
+    keySpec(): string | undefined;
+    /**
+     * The requested key usage, passed through to CreateKey in the same way.
+     */
+    keyUsage(): string | undefined;
+    /**
+     * The requested key material origin, passed through to CreateKey in the same
+     * way.
+     */
+    origin(): string | undefined;
+    /**
+     * Whether the deployed key is enabled. A key is enabled unless the template
+     * says otherwise, as on real CloudFormation.
+     */
+    enabled(): boolean;
+    private string;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-key-properties.d.ts.map

package/dist/service/kms/cfn/key/sim-cfn-kms-key-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-key-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-key-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAI1E,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE5B;IAEH,YAAY,UAAU,EAAE,gCAAgC,EAOvD;IAED;;OAEG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED;;;;;OAKG;IACH,MAAM,IAAI,MAAM,GAAG,SAAS,CAM3B;IAED;;;OAGG;IACH,OAAO,IAAI,MAAM,GAAG,SAAS,CAE5B;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;;OAGG;IACH,MAAM,IAAI,MAAM,GAAG,SAAS,CAE3B;IAED;;;OAGG;IACH,OAAO,IAAI,OAAO,CAQjB;IAED,OAAO,CAAC,MAAM;CAMf"}

package/dist/service/kms/cfn/key/sim-cfn-kms-key-properties.js

@@ -0,0 +1,74 @@
+import { SimCfnKmsPropertyParser } from "../sim-cfn-kms-property-parser.js";
+import { SimCfnKmsUnsimulatedKeyProperties } from "./sim-cfn-kms-unsimulated-key-properties.js";
+/**
+ * Reads AWS::KMS::Key CloudFormation properties into the shape the key creator
+ * needs.
+ *
+ * Keeping the property-shape rules here leaves the creator to do nothing but
+ * call CreateKey, and puts the refusals for unmodelled key behaviour in one
+ * place beside the properties they belong to.
+ *
+ * Those refusals run on construction rather than when a property is read, so
+ * a Resource asking for something unmodelled cannot get as far as creating a
+ * key that would then be wrong.
+ */
+export class SimCfnKmsKeyProperties {
+    resource;
+    properties;
+    propertyParser = new SimCfnKmsPropertyParser({
+        resourceType: "AWS::KMS::Key",
+    });
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+        new SimCfnKmsUnsimulatedKeyProperties({
+            propertyParser: this.propertyParser,
+        }).require(this.resource, this.properties);
+    }
+    /**
+     * The key Description.
+     */
+    description() {
+        return this.string(this.properties["Description"], "Description");
+    }
+    /**
+     * The key policy, as the JSON document string CreateKey takes.
+     *
+     * Omitting it gets the default root-delegation policy KMS applies, which is
+     * the same thing CreateKey does with no Policy.
+     */
+    policy() {
+        return this.propertyParser.optionalPolicyJson(this.resource, this.properties["KeyPolicy"], "KeyPolicy");
+    }
+    /**
+     * The requested key spec, passed through so CreateKey refuses the specs this
+     * simulation does not create.
+     */
+    keySpec() {
+        return this.string(this.properties["KeySpec"], "KeySpec");
+    }
+    /**
+     * The requested key usage, passed through to CreateKey in the same way.
+     */
+    keyUsage() {
+        return this.string(this.properties["KeyUsage"], "KeyUsage");
+    }
+    /**
+     * The requested key material origin, passed through to CreateKey in the same
+     * way.
+     */
+    origin() {
+        return this.string(this.properties["Origin"], "Origin");
+    }
+    /**
+     * Whether the deployed key is enabled. A key is enabled unless the template
+     * says otherwise, as on real CloudFormation.
+     */
+    enabled() {
+        return (this.propertyParser.optionalBoolean(this.resource, this.properties["Enabled"], "Enabled") ?? true);
+    }
+    string(value, name) {
+        return this.propertyParser.optionalString(this.resource, value, name);
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-key-properties.js.map

package/dist/service/kms/cfn/key/sim-cfn-kms-key-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-key-properties.js","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-key-properties.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAOhG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,sBAAsB;IAChB,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IACtC,cAAc,GAAG,IAAI,uBAAuB,CAAC;QAC5D,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;IAEH,YAAY,UAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAExC,IAAI,iCAAiC,CAAC;YACpC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAC3C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAC5B,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,eAAe,CACjC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,SAAS,CACV,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAEO,MAAM,CACZ,KAAsC,EACtC,IAAY;QAEZ,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.d.ts

@@ -0,0 +1,49 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCfnKmsPropertyParser } from "../sim-cfn-kms-property-parser.js";
+interface SimCfnKmsUnsimulatedKeyPropertiesProperties {
+    readonly propertyParser: SimCfnKmsPropertyParser;
+}
+/**
+ * Refuses AWS::KMS::Key properties that ask for behaviour simulated KMS does
+ * not model.
+ *
+ * Each of these changes what the key is, not merely how it is described, so
+ * quietly ignoring one would leave a template deploying a key that behaves
+ * differently here than it would on AWS: rotation that never happens, a
+ * multi-Region key whose replica cannot exist, or tags no policy can match.
+ * Refusing at deploy time makes that visible where it was declared.
+ */
+export declare class SimCfnKmsUnsimulatedKeyProperties {
+    private readonly propertyParser;
+    constructor(properties: SimCfnKmsUnsimulatedKeyPropertiesProperties);
+    /**
+     * Refuse the Resource if it asks for something unmodelled.
+     *
+     * KeySpec, KeyUsage and Origin are not checked here: they go through to
+     * CreateKey, which already refuses the types this simulation does not
+     * create.
+     */
+    require(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;
+    /**
+     * Automatic key rotation is not simulated.
+     *
+     * `EnableKeyRotation: false` is the AWS default and says nothing, so it is
+     * accepted.
+     */
+    private requireNoRotation;
+    /**
+     * Multi-Region keys are not simulated. A simulated key belongs to one
+     * account and region, and a ciphertext produced under it cannot be decrypted
+     * elsewhere.
+     */
+    private requireSingleRegion;
+    /**
+     * Tags are not simulated on KMS keys, so a template declaring them is
+     * refused rather than deploying a key whose tags nothing can read and no
+     * `aws:ResourceTag` condition can match.
+     */
+    private requireNoTags;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-unsimulated-key-properties.d.ts.map

package/dist/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-unsimulated-key-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,2CAA2C;IACnD,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IAEzD,YAAY,UAAU,EAAE,2CAA2C,EAElE;IAED;;;;;;OAMG;IACH,OAAO,CACL,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,IAAI,CAIN;IAED;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;;;OAIG;IACH,OAAO,CAAC,aAAa;CActB"}

package/dist/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.js

@@ -0,0 +1,72 @@
+/**
+ * Refuses AWS::KMS::Key properties that ask for behaviour simulated KMS does
+ * not model.
+ *
+ * Each of these changes what the key is, not merely how it is described, so
+ * quietly ignoring one would leave a template deploying a key that behaves
+ * differently here than it would on AWS: rotation that never happens, a
+ * multi-Region key whose replica cannot exist, or tags no policy can match.
+ * Refusing at deploy time makes that visible where it was declared.
+ */
+export class SimCfnKmsUnsimulatedKeyProperties {
+    propertyParser;
+    constructor(properties) {
+        this.propertyParser = properties.propertyParser;
+    }
+    /**
+     * Refuse the Resource if it asks for something unmodelled.
+     *
+     * KeySpec, KeyUsage and Origin are not checked here: they go through to
+     * CreateKey, which already refuses the types this simulation does not
+     * create.
+     */
+    require(resource, properties) {
+        this.requireNoRotation(resource, properties);
+        this.requireSingleRegion(resource, properties);
+        this.requireNoTags(resource, properties);
+    }
+    /**
+     * Automatic key rotation is not simulated.
+     *
+     * `EnableKeyRotation: false` is the AWS default and says nothing, so it is
+     * accepted.
+     */
+    requireNoRotation(resource, properties) {
+        const enabled = this.propertyParser.optionalBoolean(resource, properties["EnableKeyRotation"], "EnableKeyRotation");
+        if (enabled === true) {
+            throw this.propertyParser.propertyError(resource, "EnableKeyRotation is not simulated: simulated KMS keys keep the " +
+                "same key material for their lifetime, so a rotated ciphertext " +
+                "would not be modelled");
+        }
+        if (properties["RotationPeriodInDays"] !== undefined) {
+            throw this.propertyParser.propertyError(resource, "RotationPeriodInDays is not simulated: simulated KMS does not " +
+                "rotate key material");
+        }
+    }
+    /**
+     * Multi-Region keys are not simulated. A simulated key belongs to one
+     * account and region, and a ciphertext produced under it cannot be decrypted
+     * elsewhere.
+     */
+    requireSingleRegion(resource, properties) {
+        const multiRegion = this.propertyParser.optionalBoolean(resource, properties["MultiRegion"], "MultiRegion");
+        if (multiRegion === true) {
+            throw this.propertyParser.propertyError(resource, "MultiRegion is not simulated: a simulated key belongs to one " +
+                "account and region, and its ciphertext cannot be decrypted in " +
+                "another");
+        }
+    }
+    /**
+     * Tags are not simulated on KMS keys, so a template declaring them is
+     * refused rather than deploying a key whose tags nothing can read and no
+     * `aws:ResourceTag` condition can match.
+     */
+    requireNoTags(resource, properties) {
+        const tags = properties["Tags"];
+        if (tags !== undefined) {
+            throw this.propertyParser.propertyError(resource, "Tags are not simulated on KMS keys: ListResourceTags and the " +
+                "aws:ResourceTag condition key would not see them");
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-unsimulated-key-properties.js.map

package/dist/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-unsimulated-key-properties.js","sourceRoot":"","sources":["../../../../../src/service/kms/cfn/key/sim-cfn-kms-unsimulated-key-properties.ts"],"names":[],"mappings":"AAWA;;;;;;;;;GASG;AACH,MAAM,OAAO,iCAAiC;IAC3B,cAAc,CAA0B;IAEzD,YAAY,UAAuD;QACjE,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CACjD,QAAQ,EACR,UAAU,CAAC,mBAAmB,CAAC,EAC/B,mBAAmB,CACpB,CAAC;QAEF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrC,QAAQ,EACR,kEAAkE;gBAChE,gEAAgE;gBAChE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrC,QAAQ,EACR,gEAAgE;gBAC9D,qBAAqB,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CACzB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CACrD,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd,CAAC;QAEF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrC,QAAQ,EACR,+DAA+D;gBAC7D,gEAAgE;gBAChE,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,aAAa,CACnB,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAoC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrC,QAAQ,EACR,+DAA+D;gBAC7D,kDAAkD,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}