@kensio/yulin 1.13.0 → 1.14.1

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.js

@@ -0,0 +1,42 @@
+import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { SimEventBridgeDeliveryNotPermitted } from "../error/sim-event-bridge-delivery.error.js";
+import { simEventBridgeServicePrincipal } from "./sim-event-bridge-delivery.js";
+/**
+ * The session name AWS gives a role a rule assumes to run a task.
+ */
+const sessionName = "AWSEvents";
+/**
+ * Read the Account and name out of a target's role ARN.
+ */
+export function eventBridgeTargetRole(roleArn) {
+    return simServiceRoleTarget(roleArn);
+}
+/**
+ * What a rule says when it could not assume its target's role.
+ */
+const refusals = {
+    missingRole: (target) => new SimEventBridgeDeliveryNotPermitted(`${target.roleArn} is not a simulated IAM role, so the rule could not ` +
+        `assume it to run its target's task.`),
+    untrustedRole: (target, servicePrincipal) => new SimEventBridgeDeliveryNotPermitted(`The trust policy of ${target.roleArn} does not allow ` +
+        `${servicePrincipal} to assume it, so the rule could not run its ` +
+        `target's task. Add it to the role's AssumeRolePolicyDocument.`),
+};
+/**
+ * Assume a target's role, and answer with the caller it makes.
+ *
+ * Only an ECS target has one. A queue, topic or function is reached as the
+ * `events.amazonaws.com` service principal and admitted by its own resource
+ * policy, but there is no resource policy on a task definition for a rule to be
+ * admitted by, so running a task is a call the rule makes as a role of the
+ * account instead. Real EventBridge requires the role for that reason.
+ */
+export async function assumeEventBridgeTargetRole(target, iam) {
+    return await assumeSimServiceRole({
+        target,
+        servicePrincipal: simEventBridgeServicePrincipal,
+        sessionName,
+        iam,
+        refusals,
+    });
+}
+//# sourceMappingURL=sim-event-bridge-target-role.js.map

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-event-bridge-target-role.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/delivery/sim-event-bridge-target-role.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EAGpB,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAIhC;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,QAAQ,GAA2B;IACvC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,kCAAkC,CACpC,GAAG,MAAM,CAAC,OAAO,sDAAsD;QACrE,qCAAqC,CACxC;IACH,aAAa,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAC1C,IAAI,kCAAkC,CACpC,uBAAuB,MAAM,CAAC,OAAO,kBAAkB;QACrD,GAAG,gBAAgB,+CAA+C;QAClE,+DAA+D,CAClE;CACJ,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAgC,EAChC,GAAW;IAEX,OAAO,MAAM,oBAAoB,CAAC;QAChC,MAAM;QACN,gBAAgB,EAAE,8BAA8B;QAChD,WAAW;QACX,GAAG;QACH,QAAQ;KACT,CAAC,CAAC;AACL,CAAC"}

package/dist/service/eventbridge/target/sim-event-target-arn.d.ts

@@ -3,15 +3,15 @@ import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 /**
  * The services a simulated rule can send an event to.
  */
-export declare const simEventTargetServices: readonly ["lambda", "sqs", "sns"];
+export declare const simEventTargetServices: readonly ["lambda", "sqs", "sns", "ecs"];
 export type SimEventTargetService = (typeof simEventTargetServices)[number];
 /**
  * The ARN of somewhere a rule sends events.
  *
- * Target ARNs are read here rather than by `parseSimArn`, because the three
- * services this delivers to write their resource part three ways: a queue and
- * a topic put the name straight after the Account with no type in front of it,
- * and a function writes `function:<name>`.
+ * Target ARNs are read here rather than by `parseSimArn`, because the services
+ * this delivers to write their resource part several ways: a queue and a topic
+ * put the name straight after the Account with no type in front of it, a
+ * function writes `function:<name>`, and a cluster writes `cluster/<name>`.
  *
  * A target in another Account or Region is allowed, as real EventBridge
  * delivers across both.
@@ -34,6 +34,15 @@ export declare class SimEventTargetArn {
      * that cannot work says so at the point it was written.
      */
     static of(value: string | undefined): SimEventTargetArn;
+    /**
+     * Refuse an ARN of the right service that names nothing in it.
+     *
+     * Both services whose resource part carries a type are checked, because both
+     * write more than one kind of resource: `arn:aws:lambda:...:layer:shared` and
+     * `arn:aws:ecs:...:task-definition/orders:3` are well formed ARNs of a
+     * service this delivers to, and neither names anything a rule can reach.
+     */
+    private static refuseUnnamedResource;
     /**
      * The name of a Lambda function this ARN names, or nothing when it names
      * something else in Lambda.
@@ -47,5 +56,18 @@ export declare class SimEventTargetArn {
      * would read either as a function that is not there.
      */
     get functionName(): string;
+    /**
+     * The name of the ECS cluster this ARN names, or nothing when it names
+     * something else in ECS.
+     *
+     * A cluster ARN's resource is `cluster/<name>` exactly, with a slash rather
+     * than the colon Lambda uses. Both the resource type and there being nothing
+     * after the name are checked rather than assumed, because ECS writes more
+     * than clusters this way: a task definition is
+     * `task-definition/<family>:<revision>` and a task is `task/<cluster>/<id>`,
+     * and reading the first two segments alone would take a task ARN for the
+     * cluster it runs in.
+     */
+    get clusterName(): string;
 }
 //# sourceMappingURL=sim-event-target-arn.d.ts.map

package/dist/service/eventbridge/target/sim-event-target-arn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;GAEG;AACH,eAAO,MAAM,sBAAsB,YAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AA4B5E;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAMN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAyDtD;IAED;;;;;;;;;;;OAWG;IACH,IAAI,YAAY,IAAI,MAAM,CAIzB;CACF"}
+{"version":3,"file":"sim-event-target-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;GAEG;AACH,eAAO,MAAM,sBAAsB,YAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AA4B5E;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAMN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAmDtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAmBpC;;;;;;;;;;;OAWG;IACH,IAAI,YAAY,IAAI,MAAM,CAIzB;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW,IAAI,MAAM,CAQxB;CACF"}

package/dist/service/eventbridge/target/sim-event-target-arn.js

@@ -2,7 +2,7 @@ import { SimEventBridgeValidationException } from "../error/sim-event-bridge.err
 /**
  * The services a simulated rule can send an event to.
  */
-export const simEventTargetServices = ["lambda", "sqs", "sns"];
+export const simEventTargetServices = ["lambda", "sqs", "sns", "ecs"];
 /**
  * The fewest colon separated parts any target ARN has.
  */
@@ -21,10 +21,10 @@ function isTargetService(value) {
 /**
  * The ARN of somewhere a rule sends events.
  *
- * Target ARNs are read here rather than by `parseSimArn`, because the three
- * services this delivers to write their resource part three ways: a queue and
- * a topic put the name straight after the Account with no type in front of it,
- * and a function writes `function:<name>`.
+ * Target ARNs are read here rather than by `parseSimArn`, because the services
+ * this delivers to write their resource part several ways: a queue and a topic
+ * put the name straight after the Account with no type in front of it, a
+ * function writes `function:<name>`, and a cluster writes `cluster/<name>`.
  *
  * A target in another Account or Region is allowed, as real EventBridge
  * delivers across both.
@@ -87,12 +87,29 @@ export class SimEventTargetArn {
             accountId: accountId,
             resource,
         });
+        this.refuseUnnamedResource(arn);
+        return arn;
+    }
+    /**
+     * Refuse an ARN of the right service that names nothing in it.
+     *
+     * Both services whose resource part carries a type are checked, because both
+     * write more than one kind of resource: `arn:aws:lambda:...:layer:shared` and
+     * `arn:aws:ecs:...:task-definition/orders:3` are well formed ARNs of a
+     * service this delivers to, and neither names anything a rule can reach.
+     */
+    static refuseUnnamedResource(arn) {
         if (arn.service === "lambda" && arn.functionName === "") {
-            throw new SimEventBridgeValidationException(`Invalid parameter: Target Arn Reason: ${value} names no function. ` +
-                `A function ARN is ` +
+            throw new SimEventBridgeValidationException(`Invalid parameter: Target Arn Reason: ${arn.value} names no ` +
+                `function. A function ARN is ` +
                 `arn:aws:lambda:<region>:<account-id>:function:<function-name>`);
         }
-        return arn;
+        if (arn.service === "ecs" && arn.clusterName === "") {
+            throw new SimEventBridgeValidationException(`Invalid parameter: Target Arn Reason: ${arn.value} names no ` +
+                `cluster. An ECS target names the cluster the task runs in, as ` +
+                `arn:aws:ecs:<region>:<account-id>:cluster/<cluster-name>, and ` +
+                `names its task definition in EcsParameters.`);
+        }
     }
     /**
      * The name of a Lambda function this ARN names, or nothing when it names
@@ -110,5 +127,24 @@ export class SimEventTargetArn {
         const [resourceType, name = ""] = this.resource.split(":", 2);
         return resourceType === "function" ? name : "";
     }
+    /**
+     * The name of the ECS cluster this ARN names, or nothing when it names
+     * something else in ECS.
+     *
+     * A cluster ARN's resource is `cluster/<name>` exactly, with a slash rather
+     * than the colon Lambda uses. Both the resource type and there being nothing
+     * after the name are checked rather than assumed, because ECS writes more
+     * than clusters this way: a task definition is
+     * `task-definition/<family>:<revision>` and a task is `task/<cluster>/<id>`,
+     * and reading the first two segments alone would take a task ARN for the
+     * cluster it runs in.
+     */
+    get clusterName() {
+        const [resourceType, name = "", beyond] = this.resource.split("/", 3);
+        if (resourceType !== "cluster" || beyond !== undefined) {
+            return "";
+        }
+        return name;
+    }
 }
 //# sourceMappingURL=sim-event-target-arn.js.map

package/dist/service/eventbridge/target/sim-event-target-arn.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target-arn.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAIxE;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;GAGG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACZ,KAAK,CAAS;IACd,OAAO,CAAwB;IAC/B,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAE3C;;OAEG;IACa,QAAQ,CAAS;IAEjC,YAAoB,UAAuC;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAyB;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAiC,CACzC,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,IACE,MAAM,KAAK,KAAK;YAChB,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,SAAS;YACrB,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,EAAE;YAChB,QAAQ,KAAK,EAAE;YACf,KAAK,CAAC,MAAM,GAAG,eAAe,EAC9B,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,KAAK,gBAAgB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,UAAU,KAAK,UAAU,OAAO,oCAAoC;gBAClE,cAAc,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAClE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;YACnB,KAAK;YACL,OAAO;YACP,UAAU,EAAE,UAA2B;YACvC,SAAS,EAAE,SAA4B;YACvC,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,KAAK,sBAAsB;gBAClE,oBAAoB;gBACpB,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,YAAY;QACd,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;CACF"}
+{"version":3,"file":"sim-event-target-arn.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAI/E;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;GAGG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACZ,KAAK,CAAS;IACd,OAAO,CAAwB;IAC/B,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAE3C;;OAEG;IACa,QAAQ,CAAS;IAEjC,YAAoB,UAAuC;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAyB;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAiC,CACzC,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,IACE,MAAM,KAAK,KAAK;YAChB,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,SAAS;YACrB,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,EAAE;YAChB,QAAQ,KAAK,EAAE;YACf,KAAK,CAAC,MAAM,GAAG,eAAe,EAC9B,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,KAAK,gBAAgB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,UAAU,KAAK,UAAU,OAAO,oCAAoC;gBAClE,cAAc,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAClE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;YACnB,KAAK;YACL,OAAO;YACP,UAAU,EAAE,UAA2B;YACvC,SAAS,EAAE,SAA4B;YACvC,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAEhC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACzD,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,8BAA8B;gBAC9B,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,6CAA6C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,YAAY;QACd,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW;QACb,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/eventbridge/target/sim-event-target-ecs.d.ts

@@ -0,0 +1,39 @@
+import { SimEcsTargetTask, type SimEcsTargetTaskProperties } from "../../ecs/target/sim-ecs-target-task.js";
+import type { SimEventTargetArn } from "./sim-event-target-arn.js";
+/**
+ * What a target request says about running a task.
+ */
+export interface SimEventTargetTaskProperties extends SimEcsTargetTaskProperties {
+    readonly RoleArn?: string | undefined;
+}
+/**
+ * What one rule target says about the ECS task it runs.
+ *
+ * A rule runs a task as the target's own role rather than as the EventBridge
+ * service principal, which is why an ECS target is the one target type here
+ * that carries a `RoleArn`. Real EventBridge requires one for exactly the same
+ * reason: `ecs:RunTask` is a call it makes on the account's behalf rather than
+ * a delivery a resource policy can admit.
+ */
+export declare class SimEventTargetEcs {
+    readonly roleArn: string;
+    readonly task: SimEcsTargetTask;
+    private constructor();
+    /**
+     * Read what a target says about running a task, where it runs one.
+     *
+     * A target whose ARN names anything but an ECS cluster runs no task, and is
+     * refused for carrying the properties of one rather than being taken with
+     * them ignored.
+     */
+    static of(arn: SimEventTargetArn, target: SimEventTargetTaskProperties): SimEventTargetEcs | undefined;
+    /**
+     * Read the role the rule runs the task as, which it has to have.
+     *
+     * It is checked for being a role ARN when the target is added rather than
+     * when an event first matches, so a target that could never run anything
+     * says so at the point it was written.
+     */
+    private static roleArnIn;
+}
+//# sourceMappingURL=sim-event-target-ecs.d.ts.map

package/dist/service/eventbridge/target/sim-event-target-ecs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-event-target-ecs.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-ecs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,0BAA0B,EAChC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,0BAA0B;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAoCD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,IAAI,EAAE,gBAAgB,CAAC;IAEvC,OAAO,eAGN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,4BAA4B,GACnC,iBAAiB,GAAG,SAAS,CAW/B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;CAgBzB"}

package/dist/service/eventbridge/target/sim-event-target-ecs.js

@@ -0,0 +1,80 @@
+import { SimEcsTargetTask, } from "../../ecs/target/sim-ecs-target-task.js";
+import { SimEventBridgeUnsimulatedInputException, SimEventBridgeValidationException, } from "../error/sim-event-bridge.error.js";
+/**
+ * The shape an IAM role ARN has.
+ */
+const roleArnPattern = /^arn:aws[a-z-]*:iam::\d{12}:role\/.+$/u;
+/**
+ * Refuse the task properties on a target that does not run a task.
+ *
+ * A `RoleArn` on a queue, topic or function target is the one refusal here
+ * that is about EventBridge rather than about ECS: a rule reaches those three
+ * as the `events.amazonaws.com` service principal and their own resource
+ * policies decide, so a role would be taken and never used.
+ */
+function refuseTaskProperties(target) {
+    if (target.RoleArn !== undefined) {
+        throw new SimEventBridgeUnsimulatedInputException("A target RoleArn is not simulated except on an ECS target. A rule " +
+            "reaches its target as the events.amazonaws.com service principal, " +
+            "which the target's own resource policy admits.");
+    }
+    if (target.EcsParameters !== undefined) {
+        throw new SimEventBridgeUnsimulatedInputException("EcsParameters belongs to a target whose Arn names an ECS cluster, " +
+            "and this target's does not");
+    }
+}
+/**
+ * How this reports a target that could never run the task it describes.
+ */
+function refuse(reason) {
+    return new SimEventBridgeValidationException(`Invalid parameter: Targets Reason: ${reason}`);
+}
+/**
+ * What one rule target says about the ECS task it runs.
+ *
+ * A rule runs a task as the target's own role rather than as the EventBridge
+ * service principal, which is why an ECS target is the one target type here
+ * that carries a `RoleArn`. Real EventBridge requires one for exactly the same
+ * reason: `ecs:RunTask` is a call it makes on the account's behalf rather than
+ * a delivery a resource policy can admit.
+ */
+export class SimEventTargetEcs {
+    roleArn;
+    task;
+    constructor(roleArn, task) {
+        this.roleArn = roleArn;
+        this.task = task;
+    }
+    /**
+     * Read what a target says about running a task, where it runs one.
+     *
+     * A target whose ARN names anything but an ECS cluster runs no task, and is
+     * refused for carrying the properties of one rather than being taken with
+     * them ignored.
+     */
+    static of(arn, target) {
+        if (arn.service !== "ecs") {
+            refuseTaskProperties(target);
+            return undefined;
+        }
+        return new this(this.roleArnIn(target.RoleArn), SimEcsTargetTask.of(target, refuse));
+    }
+    /**
+     * Read the role the rule runs the task as, which it has to have.
+     *
+     * It is checked for being a role ARN when the target is added rather than
+     * when an event first matches, so a target that could never run anything
+     * says so at the point it was written.
+     */
+    static roleArnIn(value) {
+        if (value === undefined || value === "") {
+            throw refuse("an ECS target runs its task as a role, so it carries a RoleArn");
+        }
+        if (!roleArnPattern.test(value)) {
+            throw refuse(`'${value}' is not an IAM role ARN. One is ` +
+                `arn:aws:iam::<account-id>:role/<role-name>`);
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-event-target-ecs.js.map

package/dist/service/eventbridge/target/sim-event-target-ecs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-event-target-ecs.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-ecs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAEjB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAG5C;;GAEG;AACH,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAShE;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,MAAoC;IAChE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,uCAAuC,CAC/C,oEAAoE;YAClE,oEAAoE;YACpE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,uCAAuC,CAC/C,oEAAoE;YAClE,4BAA4B,CAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,IAAI,iCAAiC,CAC1C,sCAAsC,MAAM,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IACZ,OAAO,CAAS;IAChB,IAAI,CAAmB;IAEvC,YAAoB,OAAe,EAAE,IAAsB;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CACP,GAAsB,EACtB,MAAoC;QAEpC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC1B,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAE7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,IAAI,CACb,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAC9B,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CACpC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,CACV,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,CACV,IAAI,KAAK,mCAAmC;gBAC1C,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/eventbridge/target/sim-event-target.d.ts

@@ -1,4 +1,5 @@
 import { SimEventTargetArn } from "./sim-event-target-arn.js";
+import { SimEventTargetEcs, type SimEventTargetTaskProperties } from "./sim-event-target-ecs.js";
 /**
  * One place a rule sends the events it matches.
  *
@@ -20,14 +21,21 @@ export declare class SimEventTarget {
      * know that something happened.
      */
     readonly input: string | undefined;
+    /**
+     * What this target says about the ECS task it runs, where it runs one.
+     *
+     * An ECS target is the one target type here whose `Input` is not what the
+     * target receives: a task has nowhere to receive a payload, so the `Input`
+     * is what the task overrides instead.
+     */
+    readonly ecs: SimEventTargetEcs | undefined;
     private constructor();
     /**
      * Read a target from request input.
      */
-    static of(properties: {
+    static of(properties: SimEventTargetTaskProperties & {
         readonly Id?: string | undefined;
         readonly Arn?: string | undefined;
-        readonly Input?: string | undefined;
     }): SimEventTarget;
     /**
      * Read a target's fixed input, which has to be JSON.

package/dist/service/eventbridge/target/sim-event-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,GAAG,EAAE,iBAAiB,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,OAAO,eAIN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACrC,GAAG,cAAc,CAMjB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAgBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;CAiB1B"}
+{"version":3,"file":"sim-event-target.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAenC;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,GAAG,EAAE,iBAAiB,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C;;;;;;OAMG;IACH,SAAgB,GAAG,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEnD,OAAO,eAKN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,UAAU,EAAE,4BAA4B,GAAG;QACzC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,GACA,cAAc,CAShB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAgBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;CAiB1B"}

package/dist/service/eventbridge/target/sim-event-target.js

@@ -1,5 +1,6 @@
 import { SimEventBridgeValidationException } from "../error/sim-event-bridge.error.js";
 import { SimEventTargetArn } from "./sim-event-target-arn.js";
+import { SimEventTargetEcs, } from "./sim-event-target-ecs.js";
 /**
  * Real EventBridge allows alphanumerics, full stops, hyphens and underscores,
  * up to 64 characters, for a target id.
@@ -26,19 +27,30 @@ export class SimEventTarget {
      * know that something happened.
      */
     input;
+    /**
+     * What this target says about the ECS task it runs, where it runs one.
+     *
+     * An ECS target is the one target type here whose `Input` is not what the
+     * target receives: a task has nowhere to receive a payload, so the `Input`
+     * is what the task overrides instead.
+     */
+    ecs;
     constructor(properties) {
         this.id = properties.id;
         this.arn = properties.arn;
         this.input = properties.input;
+        this.ecs = properties.ecs;
     }
     /**
      * Read a target from request input.
      */
     static of(properties) {
+        const arn = SimEventTargetArn.of(properties.Arn);
         return new this({
             id: this.requiredId(properties.Id),
-            arn: SimEventTargetArn.of(properties.Arn),
+            arn,
             input: this.readInput(properties.Input),
+            ecs: SimEventTargetEcs.of(arn, properties),
         });
     }
     /**

package/dist/service/eventbridge/target/sim-event-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;GAGG;AACH,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAQlD;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACT,EAAE,CAAS;IACX,GAAG,CAAoB;IAEvC;;;;;;;;OAQG;IACa,KAAK,CAAqB;IAE1C,YAAoB,UAAoC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,UAIT;QACC,OAAO,IAAI,IAAI,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,EAAsB;QAC9C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,iCAAiC,CACzC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,EAAE,0BAA0B;gBACnE,mEAAmE;gBACnE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}
+{"version":3,"file":"sim-event-target.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,MAAM,eAAe,GAAG,yBAAyB,CAAC;AASlD;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACT,EAAE,CAAS;IACX,GAAG,CAAoB;IAEvC;;;;;;;;OAQG;IACa,KAAK,CAAqB;IAE1C;;;;;;OAMG;IACa,GAAG,CAAgC;IAEnD,YAAoB,UAAoC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,UAGC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEjD,OAAO,IAAI,IAAI,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YACvC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,EAAsB;QAC9C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,iCAAiC,CACzC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,EAAE,0BAA0B;gBACnE,mEAAmE;gBACnE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/service/iam/index.d.ts

@@ -6,5 +6,6 @@ export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSign
 export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -3,5 +3,6 @@ export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/request/sim-aws-control-headers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Header names that are instructions to the simulator rather than part of the
+ * request being simulated.
+ *
+ * They state who a request is from and what it is for, so anything passing a
+ * request on to a simulated service has to decide what to do with them rather
+ * than forward them by accident: the HTTP boundary strips them once the
+ * request has been attributed, and sim CloudFront strips a viewer's before
+ * deciding for itself what an Origin request says.
+ */
+export declare const simAwsControlHeaderNames: readonly string[];
+/**
+ * Remove the simulator's control headers from a set of request headers.
+ */
+export declare function stripSimAwsControlHeaders(headers: Headers): void;
+//# sourceMappingURL=sim-aws-control-headers.d.ts.map

package/dist/service/iam/request/sim-aws-control-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-control-headers.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-control-headers.ts"],"names":[],"mappings":"AAMA;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAIrD,CAAC;AAEF;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAIhE"}

package/dist/service/iam/request/sim-aws-control-headers.js

@@ -0,0 +1,26 @@
+import { simAwsCallerHeaderName } from "./sim-aws-caller-header.js";
+import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./sim-aws-request-source.js";
+/**
+ * Header names that are instructions to the simulator rather than part of the
+ * request being simulated.
+ *
+ * They state who a request is from and what it is for, so anything passing a
+ * request on to a simulated service has to decide what to do with them rather
+ * than forward them by accident: the HTTP boundary strips them once the
+ * request has been attributed, and sim CloudFront strips a viewer's before
+ * deciding for itself what an Origin request says.
+ */
+export const simAwsControlHeaderNames = [
+    simAwsCallerHeaderName,
+    simAwsSourceArnHeaderName,
+    simAwsSourceAccountHeaderName,
+];
+/**
+ * Remove the simulator's control headers from a set of request headers.
+ */
+export function stripSimAwsControlHeaders(headers) {
+    for (const name of simAwsControlHeaderNames) {
+        headers.delete(name);
+    }
+}
+//# sourceMappingURL=sim-aws-control-headers.js.map

package/dist/service/iam/request/sim-aws-control-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-control-headers.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-control-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,sBAAsB;IACtB,yBAAyB;IACzB,6BAA6B;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/service/iam/request/sim-aws-request-source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The header naming the AWS resource a request is being made on behalf of.
+ *
+ * When one AWS service calls another it says what it is calling for, and IAM
+ * supplies that as `aws:SourceArn`. A resource policy granting a service
+ * principal is normally conditioned on it, so that a Distribution or a Bucket
+ * can be granted rather than the whole service. Nothing about an HTTP request
+ * arriving in process says any of that, so the caller states it the same way it
+ * states who it is.
+ */
+export declare const simAwsSourceArnHeaderName = "x-sim-aws-source-arn";
+/**
+ * The header naming the Account owning the resource the request is made on
+ * behalf of, supplied by IAM as `aws:SourceAccount`.
+ */
+export declare const simAwsSourceAccountHeaderName = "x-sim-aws-source-account";
+interface SimAwsRequestSourceProperties {
+    readonly arn?: string | undefined;
+    readonly accountId?: string | undefined;
+}
+/**
+ * What a request says it is being made on behalf of.
+ *
+ * This is separate from the caller: the caller is who is asking, and this is
+ * which of their resources they are asking for. Only a service principal has
+ * one in practice, since that is the case AWS supplies the condition keys for.
+ */
+export declare class SimAwsRequestSource {
+    readonly arn: string | undefined;
+    readonly accountId: string | undefined;
+    constructor(properties: SimAwsRequestSourceProperties);
+    /**
+     * Read the source a request states, or nothing when it states none.
+     *
+     * A request carrying neither header has no source rather than an empty one,
+     * so a policy conditioned on either fails to match instead of matching an
+     * empty string. A header present but empty is the same thing said a
+     * different way, and is read the same, since no AWS service names a resource
+     * by sending nothing.
+     */
+    static fromHeaders(headers: Headers): SimAwsRequestSource | undefined;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-source.d.ts.map

package/dist/service/iam/request/sim-aws-request-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-source.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,UAAU,6BAA6B;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CASpE;CACF"}

package/dist/service/iam/request/sim-aws-request-source.js

@@ -0,0 +1,58 @@
+/**
+ * The header naming the AWS resource a request is being made on behalf of.
+ *
+ * When one AWS service calls another it says what it is calling for, and IAM
+ * supplies that as `aws:SourceArn`. A resource policy granting a service
+ * principal is normally conditioned on it, so that a Distribution or a Bucket
+ * can be granted rather than the whole service. Nothing about an HTTP request
+ * arriving in process says any of that, so the caller states it the same way it
+ * states who it is.
+ */
+export const simAwsSourceArnHeaderName = "x-sim-aws-source-arn";
+/**
+ * The header naming the Account owning the resource the request is made on
+ * behalf of, supplied by IAM as `aws:SourceAccount`.
+ */
+export const simAwsSourceAccountHeaderName = "x-sim-aws-source-account";
+/**
+ * What a request says it is being made on behalf of.
+ *
+ * This is separate from the caller: the caller is who is asking, and this is
+ * which of their resources they are asking for. Only a service principal has
+ * one in practice, since that is the case AWS supplies the condition keys for.
+ */
+export class SimAwsRequestSource {
+    arn;
+    accountId;
+    constructor(properties) {
+        this.arn = properties.arn;
+        this.accountId = properties.accountId;
+    }
+    /**
+     * Read the source a request states, or nothing when it states none.
+     *
+     * A request carrying neither header has no source rather than an empty one,
+     * so a policy conditioned on either fails to match instead of matching an
+     * empty string. A header present but empty is the same thing said a
+     * different way, and is read the same, since no AWS service names a resource
+     * by sending nothing.
+     */
+    static fromHeaders(headers) {
+        const arn = stated(headers.get(simAwsSourceArnHeaderName));
+        const accountId = stated(headers.get(simAwsSourceAccountHeaderName));
+        if (arn === undefined && accountId === undefined) {
+            return undefined;
+        }
+        return new SimAwsRequestSource({ arn, accountId });
+    }
+}
+/**
+ * One header value, or nothing when the request did not really state it.
+ */
+function stated(value) {
+    if (value === null || value.trim().length === 0) {
+        return undefined;
+    }
+    return value;
+}
+//# sourceMappingURL=sim-aws-request-source.js.map

package/dist/service/iam/request/sim-aws-request-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-source.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAOxE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACd,GAAG,CAAqB;IACxB,SAAS,CAAqB;IAE9C,YAAY,UAAyC;QACnD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAErE,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;CACF;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,KAAoB;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}