@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js

@@ -23,7 +23,7 @@ export class SimKmsKeyPolicyCommands {
     get(command, options) {
         this.requireDefaultPolicyName(command.input.PolicyName);
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:GetKeyPolicy", key, options?.caller);
+        this.authorizer.authorizeKey("kms:GetKeyPolicy", key, options);
         return {
             $metadata: {},
             PolicyName: simKmsKeyPolicyName,
@@ -41,7 +41,7 @@ export class SimKmsKeyPolicyCommands {
         }
         const document = this.policyDocument.parse(policy);
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:PutKeyPolicy", key, options?.caller);
+        this.authorizer.authorizeKey("kms:PutKeyPolicy", key, options);
         key.policy.replaceWith(document);
         return { $metadata: {} };
     }

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-policy-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAkB5E;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAA6C;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvE,OAAO;YACL,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAEpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,UAA8B;QAC7D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,mBAAmB,qCAAqC,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-policy-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAc5E;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAA6C;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAA8B;QAE9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAE/D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAA8B;QAE9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAEpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,UAA8B;QAC7D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,mBAAmB,qCAAqC,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
 import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
 import type { SimListKeysCommand, SimListKeysCommandOutput } from "./key.command.js";
@@ -6,9 +6,6 @@ interface SimKmsListKeysProperties {
     readonly keys: SimKmsKeyStore;
     readonly authorizer: SimKmsAuthorizer;
 }
-interface SimKmsListKeysOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The ListKeys command of one simulated KMS scope.
  *
@@ -23,7 +20,7 @@ export declare class SimKmsListKeys {
     /**
      * List the keys in this scope, up to any requested limit.
      */
-    handle(command: SimListKeysCommand, options?: SimKmsListKeysOptions): SimListKeysCommandOutput;
+    handle(command: SimListKeysCommand, options?: SimKmsRequestOptions): SimListKeysCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-list-keys.d.ts.map

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-list-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,kBAAkB,CAAC;AAE1B,UAAU,wBAAwB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,YAAY,UAAU,EAAE,wBAAwB,EAG/C;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,wBAAwB,CAc1B;CACF"}
+{"version":3,"file":"sim-kms-list-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,kBAAkB,CAAC;AAE1B,UAAU,wBAAwB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,YAAY,UAAU,EAAE,wBAAwB,EAG/C;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,wBAAwB,CAc1B;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.js

@@ -16,7 +16,7 @@ export class SimKmsListKeys {
      * List the keys in this scope, up to any requested limit.
      */
     handle(command, options) {
-        this.authorizer.authorizeAccount("kms:ListKeys", options?.caller);
+        this.authorizer.authorizeAccount("kms:ListKeys", options);
         const limit = command.input?.Limit;
         const entries = this.keys.keys
             .values()

package/dist/service/kms/command/key/sim-kms-list-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-list-keys.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACR,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAE9C,YAAY,UAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2B,EAC3B,OAA+B;QAE/B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;aACrD,OAAO,EAAE,CAAC;QAEb,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-kms-list-keys.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACR,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAE9C,YAAY,UAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2B,EAC3B,OAA8B;QAE9B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;aACrD,OAAO,EAAE,CAAC;QAEb,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/kms/command/sim-kms-request-options.d.ts

@@ -0,0 +1,24 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The request context a simulated KMS operation is made in.
+ *
+ * Both parts are request metadata the simulator takes on trust, in the way a
+ * real KMS request carries them: who is making the call, and whether it
+ * arrived through another AWS service rather than from the caller directly.
+ */
+export interface SimKmsRequestOptions {
+    /**
+     * The principal making the request. Defaults to the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The service making the request on the caller's behalf, named as a service
+     * such as `ssm` rather than as an endpoint.
+     *
+     * It becomes the `kms:ViaService` condition value for the request, using the
+     * region the key belongs to. A caller reaching KMS directly leaves it unset,
+     * and a policy conditioned on `kms:ViaService` then does not match.
+     */
+    readonly viaService?: string | undefined;
+}
+//# sourceMappingURL=sim-kms-request-options.d.ts.map

package/dist/service/kms/command/sim-kms-request-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-request-options.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-request-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C"}

package/dist/service/kms/command/sim-kms-request-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-kms-request-options.js.map

package/dist/service/kms/command/sim-kms-request-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-request-options.js","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-request-options.ts"],"names":[],"mappings":""}

package/dist/service/kms/index.d.ts

@@ -1,4 +1,5 @@
-export { SimKms, type SimKmsRequestOptions } from "./sim-kms.js";
+export { SimKms } from "./sim-kms.js";
+export type { SimKmsRequestOptions } from "./command/sim-kms-request-options.js";
 export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, type SimKmsKeyId, } from "./key/sim-kms-key.js";
 export { SimKmsAlias } from "./key/sim-kms-alias.js";
 export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";

package/dist/service/kms/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/key/sim-kms-caller-account.d.ts

@@ -0,0 +1,25 @@
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamCallerConditionSource } from "../../iam/authorize/context/sim-iam-caller-condition-source.js";
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * The condition key naming the Account a KMS request came from.
+ */
+export declare const simKmsCallerAccountConditionKey = "kms:CallerAccount";
+/**
+ * Supplies `kms:CallerAccount` from the caller IAM resolved.
+ *
+ * This is the other half of the AWS managed key policy: the policy admits any
+ * principal reaching the key through the owning service, so it has to say
+ * which Account those principals may belong to.
+ *
+ * A caller with no Account, such as an anonymous or service principal, leaves
+ * the key out of the condition context, and a policy conditioned on it then
+ * fails to match rather than matching anything.
+ */
+export declare class SimKmsCallerAccountCondition implements SimIamCallerConditionSource {
+    /**
+     * The Account of the resolved caller, where it has one.
+     */
+    conditionValuesFor(caller: SimAwsResolvedCaller): Readonly<Record<string, SimIamConditionValue>>;
+}
+//# sourceMappingURL=sim-kms-caller-account.d.ts.map

package/dist/service/kms/key/sim-kms-caller-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-caller-account.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-caller-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;GAEG;AACH,eAAO,MAAM,+BAA+B,sBAAsB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,qBAAa,4BAA6B,YAAW,2BAA2B;IAC9E;;OAEG;IACH,kBAAkB,CAChB,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAMhD;CACF"}

package/dist/service/kms/key/sim-kms-caller-account.js

@@ -0,0 +1,27 @@
+/**
+ * The condition key naming the Account a KMS request came from.
+ */
+export const simKmsCallerAccountConditionKey = "kms:CallerAccount";
+/**
+ * Supplies `kms:CallerAccount` from the caller IAM resolved.
+ *
+ * This is the other half of the AWS managed key policy: the policy admits any
+ * principal reaching the key through the owning service, so it has to say
+ * which Account those principals may belong to.
+ *
+ * A caller with no Account, such as an anonymous or service principal, leaves
+ * the key out of the condition context, and a policy conditioned on it then
+ * fails to match rather than matching anything.
+ */
+export class SimKmsCallerAccountCondition {
+    /**
+     * The Account of the resolved caller, where it has one.
+     */
+    conditionValuesFor(caller) {
+        if (caller.accountId === undefined) {
+            return {};
+        }
+        return { [simKmsCallerAccountConditionKey]: caller.accountId };
+    }
+}
+//# sourceMappingURL=sim-kms-caller-account.js.map

package/dist/service/kms/key/sim-kms-caller-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-caller-account.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-caller-account.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,kBAAkB,CAChB,MAA4B;QAE5B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-factory.d.ts

@@ -1,7 +1,7 @@
 import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
-import { SimKmsKey, type SimKmsKeyManager } from "./sim-kms-key.js";
+import { SimKmsKey } from "./sim-kms-key.js";
 interface SimKmsKeyFactoryProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly clock: SimClock;
@@ -9,7 +9,14 @@ interface SimKmsKeyFactoryProperties {
 interface SimKmsMakeKeyProperties {
     readonly description?: string | undefined;
     readonly policy?: SimIamPolicyDocument | undefined;
-    readonly keyManager?: SimKmsKeyManager | undefined;
+    /**
+     * The service an AWS managed key belongs to, such as `ssm`.
+     *
+     * Naming it is what makes the key an AWS managed one: it decides both the
+     * key manager and the via-service-scoped policy real AWS gives such a key,
+     * so the two cannot disagree.
+     */
+    readonly awsManagedService?: string | undefined;
 }
 /**
  * Builds simulated KMS keys, including their key material.
@@ -30,6 +37,14 @@ export declare class SimKmsKeyFactory {
      * these are real UUIDs rather than a shorter simulator-only identifier.
      */
     make(properties?: SimKmsMakeKeyProperties): SimKmsKey;
+    /**
+     * Who manages the key, which is decided by whether a service owns it.
+     */
+    private keyManager;
+    /**
+     * The policy the key starts with: the one asked for, the AWS managed one, or
+     * the customer default.
+     */
     private keyPolicy;
 }
 export {};

package/dist/service/kms/key/sim-kms-key-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAaxD;IAED,OAAO,CAAC,SAAS;CAUlB"}
+{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAoB,MAAM,kBAAkB,CAAC;AAK/D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAaxD;IAED;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAuBlB"}

package/dist/service/kms/key/sim-kms-key-factory.js

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
 import { SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
-import { SimKmsKey } from "./sim-kms-key.js";
+import { SimKmsKey, SimKmsKeyManager } from "./sim-kms-key.js";
 import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
 import { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+import { SimKmsViaService } from "./sim-kms-via-service.js";
 /**
  * Builds simulated KMS keys, including their key material.
  *
@@ -31,17 +32,34 @@ export class SimKmsKeyFactory {
             keyId,
             accountRegionScope: this.accountRegionScope,
             material: new SimKmsKeyMaterial({ keyArn: arn, blob: this.blob }),
-            policy: this.keyPolicy(arn, properties.policy),
+            policy: this.keyPolicy(arn, properties),
             creationDate: this.clock.now(),
             description: properties.description,
-            keyManager: properties.keyManager,
+            keyManager: this.keyManager(properties),
         });
     }
-    keyPolicy(keyArn, document) {
-        if (document === undefined) {
-            return SimKmsKeyPolicy.default(keyArn, this.accountRegionScope.accountId);
+    /**
+     * Who manages the key, which is decided by whether a service owns it.
+     */
+    keyManager(properties) {
+        if (properties.awsManagedService === undefined) {
+            return undefined;
+        }
+        return SimKmsKeyManager.Aws;
+    }
+    /**
+     * The policy the key starts with: the one asked for, the AWS managed one, or
+     * the customer default.
+     */
+    keyPolicy(keyArn, properties) {
+        if (properties.policy !== undefined) {
+            return new SimKmsKeyPolicy(keyArn, properties.policy);
+        }
+        const accountId = this.accountRegionScope.accountId;
+        if (properties.awsManagedService !== undefined) {
+            return SimKmsKeyPolicy.awsManaged(keyArn, accountId, new SimKmsViaService(properties.awsManagedService, this.accountRegionScope.regionName));
         }
-        return new SimKmsKeyPolicy(keyArn, document);
+        return SimKmsKeyPolicy.default(keyArn, accountId);
     }
 }
 //# sourceMappingURL=sim-kms-key-factory.js.map

package/dist/service/kms/key/sim-kms-key-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAyB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAa1D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9C,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CACf,MAAc,EACd,QAA0C;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAqB5D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,UAAmC;QAEnC,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,gBAAgB,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,MAAc,EACd,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAEpD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,eAAe,CAAC,UAAU,CAC/B,MAAM,EACN,SAAS,EACT,IAAI,gBAAgB,CAClB,UAAU,CAAC,iBAAiB,EAC5B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACnC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-policy.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { type SimKmsViaService } from "./sim-kms-via-service.js";
 /**
  * The name real KMS reports a key's policy under. A KMS key has exactly one
  * policy and it is always called this.
@@ -29,6 +30,19 @@ export declare class SimKmsKeyPolicy {
      * IAM policy will widen that.
      */
     static default(keyArn: string, accountId: SimAwsAccountId): SimKmsKeyPolicy;
+    /**
+     * Build the policy real AWS gives an AWS managed key.
+     *
+     * It is not the customer default with a different name on it. It grants use
+     * of the key to the Account's principals only when the request reaches KMS
+     * through the service that owns the key, and it delegates nothing else to
+     * IAM: the second statement covers reading the key's metadata and no more.
+     *
+     * That is what makes an AWS managed key usable by a caller holding no KMS
+     * permission at all, and unusable by a caller holding kms:Decrypt on it who
+     * calls KMS directly.
+     */
+    static awsManaged(keyArn: string, accountId: SimAwsAccountId, viaService: SimKmsViaService): SimKmsKeyPolicy;
     /**
      * The stored policy document.
      */

package/dist/service/kms/key/sim-kms-key-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,cAAc,CAAuB;IAE7C,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAGzD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,eAAe,CAc1E;IAED;;OAEG;IACH,QAAQ,IAAI,oBAAoB,CAE/B;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,gBAAgB,IAAI,yBAAyB,CAM5C;CACF"}
+{"version":3,"file":"sim-kms-key-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,cAAc,CAAuB;IAE7C,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAGzD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,eAAe,CAc1E;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,UAAU,CACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,gBAAgB,GAC3B,eAAe,CAkCjB;IAED;;OAEG;IACH,QAAQ,IAAI,oBAAoB,CAE/B;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,gBAAgB,IAAI,yBAAyB,CAM5C;CACF"}

package/dist/service/kms/key/sim-kms-key-policy.js

@@ -1,3 +1,5 @@
+import { simKmsCallerAccountConditionKey } from "./sim-kms-caller-account.js";
+import { simKmsViaServiceConditionKey, } from "./sim-kms-via-service.js";
 /**
  * The name real KMS reports a key's policy under. A KMS key has exactly one
  * policy and it is always called this.
@@ -43,6 +45,53 @@ export class SimKmsKeyPolicy {
             ],
         });
     }
+    /**
+     * Build the policy real AWS gives an AWS managed key.
+     *
+     * It is not the customer default with a different name on it. It grants use
+     * of the key to the Account's principals only when the request reaches KMS
+     * through the service that owns the key, and it delegates nothing else to
+     * IAM: the second statement covers reading the key's metadata and no more.
+     *
+     * That is what makes an AWS managed key usable by a caller holding no KMS
+     * permission at all, and unusable by a caller holding kms:Decrypt on it who
+     * calls KMS directly.
+     */
+    static awsManaged(keyArn, accountId, viaService) {
+        return new SimKmsKeyPolicy(keyArn, {
+            Version: "2012-10-17",
+            Id: `auto-${viaService.serviceName}-1`,
+            Statement: [
+                {
+                    Sid: `Allow access through ${viaService.serviceName} for all principals in the account that are authorized to use ${viaService.serviceName}`,
+                    Effect: "Allow",
+                    Principal: { AWS: "*" },
+                    Action: [
+                        "kms:Encrypt",
+                        "kms:Decrypt",
+                        "kms:ReEncrypt*",
+                        "kms:GenerateDataKey*",
+                        "kms:CreateGrant",
+                        "kms:DescribeKey",
+                    ],
+                    Resource: "*",
+                    Condition: {
+                        StringEquals: {
+                            [simKmsCallerAccountConditionKey]: accountId,
+                            [simKmsViaServiceConditionKey]: viaService.value,
+                        },
+                    },
+                },
+                {
+                    Sid: "Allow direct access to key metadata to the account",
+                    Effect: "Allow",
+                    Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+                    Action: ["kms:Describe*", "kms:Get*", "kms:List*", "kms:RevokeGrant"],
+                    Resource: "*",
+                },
+            ],
+        });
+    }
     /**
      * The stored policy document.
      */

package/dist/service/kms/key/sim-kms-key-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-policy.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAS;IACxB,cAAc,CAAuB;IAE7C,YAAY,MAAc,EAAE,QAA8B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAc,EAAE,SAA0B;QACvD,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,YAAY;YACrB,EAAE,EAAE,eAAe;YACnB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,6BAA6B;oBAClC,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,gBAAgB,SAAS,OAAO,EAAE;oBACpD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA8B;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,UAAU,EAAE,mBAAmB;YAC/B,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-policy.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,4BAA4B,GAE7B,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAS;IACxB,cAAc,CAAuB;IAE7C,YAAY,MAAc,EAAE,QAA8B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAc,EAAE,SAA0B;QACvD,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,YAAY;YACrB,EAAE,EAAE,eAAe;YACnB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,6BAA6B;oBAClC,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,gBAAgB,SAAS,OAAO,EAAE;oBACpD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,UAAU,CACf,MAAc,EACd,SAA0B,EAC1B,UAA4B;QAE5B,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,YAAY;YACrB,EAAE,EAAE,QAAQ,UAAU,CAAC,WAAW,IAAI;YACtC,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,wBAAwB,UAAU,CAAC,WAAW,iEAAiE,UAAU,CAAC,WAAW,EAAE;oBAC5I,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvB,MAAM,EAAE;wBACN,aAAa;wBACb,aAAa;wBACb,gBAAgB;wBAChB,sBAAsB;wBACtB,iBAAiB;wBACjB,iBAAiB;qBAClB;oBACD,QAAQ,EAAE,GAAG;oBACb,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,CAAC,+BAA+B,CAAC,EAAE,SAAS;4BAC5C,CAAC,4BAA4B,CAAC,EAAE,UAAU,CAAC,KAAK;yBACjD;qBACF;iBACF;gBACD;oBACE,GAAG,EAAE,oDAAoD;oBACzD,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,gBAAgB,SAAS,OAAO,EAAE;oBACpD,MAAM,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC;oBACrE,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA8B;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,UAAU,EAAE,mBAAmB;YAC/B,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-store.d.ts

@@ -1,6 +1,6 @@
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import { SimKmsAlias } from "./sim-kms-alias.js";
-import { type SimKmsKey, type SimKmsKeyId } from "./sim-kms-key.js";
+import type { SimKmsKey, SimKmsKeyId } from "./sim-kms-key.js";
 import type { SimKmsKeyFactory } from "./sim-kms-key-factory.js";
 interface SimKmsKeyStoreProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -59,6 +59,10 @@ export declare class SimKmsKeyStore {
     private findByAlias;
     /**
      * Create an AWS managed key on first reference to its reserved alias.
+     *
+     * The service that owns the key is the part of the alias after the reserved
+     * prefix, so `alias/aws/ssm` is the key Systems Manager owns. That is also
+     * the service its policy is scoped to through `kms:ViaService`.
      */
     private makeAwsManagedKey;
 }

package/dist/service/kms/key/sim-kms-key-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-store.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAM1F,OAAO,EAAE,WAAW,EAAwB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,SAAgB,IAAI,yBAAqC;IACzD,SAAgB,OAAO,2BAAkC;IAEzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IAExD,YAAY,UAAU,EAAE,wBAAwB,EAM/C;IAED;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAc5C;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAYzC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,WAAW,CAgB7D;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAEpD;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,CAQjE;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAW1B"}
+{"version":3,"file":"sim-kms-key-store.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAM1F,OAAO,EAAE,WAAW,EAAwB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,SAAgB,IAAI,yBAAqC;IACzD,SAAgB,OAAO,2BAAkC;IAEzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IAExD,YAAY,UAAU,EAAE,wBAAwB,EAM/C;IAED;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAc5C;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAYzC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,WAAW,CAgB7D;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAEpD;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,CAQjE;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAa1B"}

package/dist/service/kms/key/sim-kms-key-store.js

@@ -1,7 +1,6 @@
 import { SimKmsAlreadyExistsException, SimKmsNotFoundException, SimKmsValidationException, } from "../error/sim-kms.error.js";
 import { SimKmsAlias, simKmsAwsAliasPrefix } from "./sim-kms-alias.js";
 import { SimKmsKeyIdentifierParser } from "./sim-kms-key-identifier.js";
-import { SimKmsKeyManager, } from "./sim-kms-key.js";
 /**
  * The keys and aliases of one simulated KMS scope, and how a KeyId resolves.
  *
@@ -107,11 +106,16 @@ export class SimKmsKeyStore {
     }
     /**
      * Create an AWS managed key on first reference to its reserved alias.
+     *
+     * The service that owns the key is the part of the alias after the reserved
+     * prefix, so `alias/aws/ssm` is the key Systems Manager owns. That is also
+     * the service its policy is scoped to through `kms:ViaService`.
      */
     makeAwsManagedKey(aliasName) {
+        const serviceName = aliasName.slice(simKmsAwsAliasPrefix.length);
         const key = this.keyFactory.make({
-            description: `Default key that protects my ${aliasName.slice(simKmsAwsAliasPrefix.length)} resources when no other key is defined`,
-            keyManager: SimKmsKeyManager.Aws,
+            description: `Default key that protects my ${serviceName} resources when no other key is defined`,
+            awsManagedService: serviceName,
         });
         this.add(key);
         this.addAlias(aliasName, key);

package/dist/service/kms/key/sim-kms-key-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-store.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAQ1B;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACT,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExC,kBAAkB,CAA2B;IAC7C,UAAU,CAAmB;IAC7B,WAAW,CAA4B;IAExD,YAAY,UAAoC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,yBAAyB,CAC9C,UAAU,CAAC,kBAAkB,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAc;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAyB;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,+BAA+B,IAAI,CAAC,kBAAkB,CAAC,SAAS,WAAW,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAa;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAiB,EAAE,SAAoB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAA4B,CACpC,UAAU,SAAS,kBAAkB,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,SAAS;YACT,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,gCAAgC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,yCAAyC;YAClI,UAAU,EAAE,gBAAgB,CAAC,GAAG;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9B,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-store.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AASxE;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACT,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExC,kBAAkB,CAA2B;IAC7C,UAAU,CAAmB;IAC7B,WAAW,CAA4B;IAExD,YAAY,UAAoC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,yBAAyB,CAC9C,UAAU,CAAC,kBAAkB,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAc;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAyB;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,+BAA+B,IAAI,CAAC,kBAAkB,CAAC,SAAS,WAAW,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAa;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAiB,EAAE,SAAoB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAA4B,CACpC,UAAU,SAAS,kBAAkB,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,SAAS;YACT,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,SAAiB;QACzC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,gCAAgC,WAAW,yCAAyC;YACjG,iBAAiB,EAAE,WAAW;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9B,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-via-service.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The condition key naming the service a KMS request was made through.
+ */
+export declare const simKmsViaServiceConditionKey = "kms:ViaService";
+/**
+ * The service a KMS request reached KMS through, as `kms:ViaService` names it.
+ *
+ * A request a caller makes itself has no value for this key. It is set when
+ * another service calls KMS on the caller's behalf, which is how a caller with
+ * no KMS permission of its own can use an AWS managed key through the service
+ * that owns it, and only through that service.
+ *
+ * The value is always the service's endpoint in the key's own region, since a
+ * key can only be used in the region it belongs to.
+ */
+export declare class SimKmsViaService {
+    readonly serviceName: string;
+    private readonly regionName;
+    constructor(serviceName: string, regionName: string);
+    /**
+     * The `kms:ViaService` condition value, such as `ssm.eu-west-2.amazonaws.com`.
+     */
+    get value(): string;
+    /**
+     * This value as a condition context entry.
+     */
+    asConditionContext(): Readonly<Record<string, string>>;
+    /**
+     * Refuse a whole endpoint where a service name is wanted.
+     *
+     * The region is the key's own, so a caller passing `ssm.us-east-1.amazonaws.com`
+     * would otherwise produce a value naming a region twice, and every policy
+     * condition would quietly stop matching.
+     */
+    private refuseEndpoint;
+}
+//# sourceMappingURL=sim-kms-via-service.d.ts.map

package/dist/service/kms/key/sim-kms-via-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-via-service.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-via-service.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAKlD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;OAEG;IACH,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAErD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;CAQvB"}

package/dist/service/kms/key/sim-kms-via-service.js

@@ -0,0 +1,50 @@
+/**
+ * The condition key naming the service a KMS request was made through.
+ */
+export const simKmsViaServiceConditionKey = "kms:ViaService";
+/**
+ * The service a KMS request reached KMS through, as `kms:ViaService` names it.
+ *
+ * A request a caller makes itself has no value for this key. It is set when
+ * another service calls KMS on the caller's behalf, which is how a caller with
+ * no KMS permission of its own can use an AWS managed key through the service
+ * that owns it, and only through that service.
+ *
+ * The value is always the service's endpoint in the key's own region, since a
+ * key can only be used in the region it belongs to.
+ */
+export class SimKmsViaService {
+    serviceName;
+    regionName;
+    constructor(serviceName, regionName) {
+        this.refuseEndpoint(serviceName);
+        this.serviceName = serviceName;
+        this.regionName = regionName;
+    }
+    /**
+     * The `kms:ViaService` condition value, such as `ssm.eu-west-2.amazonaws.com`.
+     */
+    get value() {
+        return `${this.serviceName}.${this.regionName}.amazonaws.com`;
+    }
+    /**
+     * This value as a condition context entry.
+     */
+    asConditionContext() {
+        return { [simKmsViaServiceConditionKey]: this.value };
+    }
+    /**
+     * Refuse a whole endpoint where a service name is wanted.
+     *
+     * The region is the key's own, so a caller passing `ssm.us-east-1.amazonaws.com`
+     * would otherwise produce a value naming a region twice, and every policy
+     * condition would quietly stop matching.
+     */
+    refuseEndpoint(serviceName) {
+        if (serviceName.includes(".")) {
+            throw new Error(`A simulated KMS request names the service it came through by name, ` +
+                `such as 'ssm', rather than by endpoint: ${serviceName}`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-via-service.js.map

package/dist/service/kms/key/sim-kms-via-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-via-service.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-via-service.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IACX,WAAW,CAAS;IAEnB,UAAU,CAAS;IAEpC,YAAY,WAAmB,EAAE,UAAkB;QACjD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,gBAAgB,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,EAAE,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,WAAmB;QACxC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,2CAA2C,WAAW,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/sim-kms.d.ts

@@ -1,15 +1,12 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
-import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type * as simKmsCommands from "./command/sim-kms-command.types.js";
+import type { SimKmsRequestOptions } from "./command/sim-kms-request-options.js";
 import { SimKmsCfnResourceFactory } from "./cfn/sim-cfn-kms-resource-factory.js";
 import type { SimKmsAlias } from "./key/sim-kms-alias.js";
 import type { SimKmsKey } from "./key/sim-kms-key.js";
-export interface SimKmsRequestOptions {
-    readonly caller?: SimAwsCaller;
-}
 interface SimKmsProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly iam?: SimIamInterServiceAuthZ;