@kensio/yulin 1.14.2 → 1.15.0

package/dist/service/lambda/sim-lambda-commands.js

@@ -35,7 +35,7 @@ export class SimLambdaCommands {
     permissions;
     eventSourceMappings;
     constructor(properties) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, vmSdkModuleProvider, 
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, vmSdkModuleProvider, logs, 
         // A standalone SimLambda is not reachable over HTTP, so its own registry
         // is enough; a SimAws-created one shares the environment-wide registry
         // the serving layer routes with.
@@ -95,6 +95,7 @@ export class SimLambdaCommands {
             codeStore,
             containerImages,
             vmSdkModuleProvider,
+            logs,
         });
     }
 }

package/dist/service/lambda/sim-lambda-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-commands.js","sourceRoot":"","sources":["../../../src/service/lambda/sim-lambda-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAEjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,4EAA4E,CAAC;AACjI,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,sDAAsD,CAAC;AAG9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAE3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAuB7E;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;;OAIG;IACa,eAAe,CAA2B;IAE1C,gBAAgB,CAA4B;IAC5C,cAAc,CAA0B;IACxC,SAAS,CAA4B;IACrC,YAAY,CAA+B;IAC3C,WAAW,CAA8B;IACzC,mBAAmB,CAAsC;IAEzE,YAAY,UAAuC;QACjD,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,SAAS,EACT,mBAAmB;QACnB,yEAAyE;QACzE,uEAAuE;QACvE,iCAAiC;QACjC,WAAW,GAAG,IAAI,oBAAoB,EAAE;QACxC,yEAAyE;QACzE,gEAAgE;QAChE,cAAc;QACd,iBAAiB,GAAG,IAAI,4BAA4B,EAAE,EACtD,kBAAkB,GAAG,IAAI,6BAA6B,EAAE;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,eAAe,GAAG,IAAI,0BAA0B,EAAE,GACnD,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,IAAI,CAAC,cAAc,GAAG,IAAI,uBAAuB,CAAC;YAChD,kBAAkB;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,yBAAyB,CAAC;YACpD,kBAAkB;YAClB,WAAW;YACX,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,4BAA4B,CAAC;YACnD,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,2BAA2B,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,mCAAmC,CAAC;YACjE,kBAAkB;YAClB,OAAO,EAAE,IAAI,2BAA2B,CAAC;gBACvC,SAAS,EAAE,IAAI,CAAC,cAAc;gBAC9B,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU;aACX,CAAC;YACF,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,yBAAyB,CAAC;YAC7C,kBAAkB;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,GAAG;YACH,UAAU;YACV,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,yEAAyE;YACzE,mDAAmD;YACnD,oBAAoB,EAAE,IAAI,6BAA6B,EAAE;YACzD,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-commands.js","sourceRoot":"","sources":["../../../src/service/lambda/sim-lambda-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAEjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,4EAA4E,CAAC;AACjI,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAEL,0BAA0B,GAC3B,MAAM,sDAAsD,CAAC;AAI9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAE3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAwB7E;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;;OAIG;IACa,eAAe,CAA2B;IAE1C,gBAAgB,CAA4B;IAC5C,cAAc,CAA0B;IACxC,SAAS,CAA4B;IACrC,YAAY,CAA+B;IAC3C,WAAW,CAA8B;IACzC,mBAAmB,CAAsC;IAEzE,YAAY,UAAuC;QACjD,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,SAAS,EACT,mBAAmB,EACnB,IAAI;QACJ,yEAAyE;QACzE,uEAAuE;QACvE,iCAAiC;QACjC,WAAW,GAAG,IAAI,oBAAoB,EAAE;QACxC,yEAAyE;QACzE,gEAAgE;QAChE,cAAc;QACd,iBAAiB,GAAG,IAAI,4BAA4B,EAAE,EACtD,kBAAkB,GAAG,IAAI,6BAA6B,EAAE;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,eAAe,GAAG,IAAI,0BAA0B,EAAE,GACnD,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,IAAI,CAAC,cAAc,GAAG,IAAI,uBAAuB,CAAC;YAChD,kBAAkB;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,yBAAyB,CAAC;YACpD,kBAAkB;YAClB,WAAW;YACX,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,4BAA4B,CAAC;YACnD,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,2BAA2B,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,mCAAmC,CAAC;YACjE,kBAAkB;YAClB,OAAO,EAAE,IAAI,2BAA2B,CAAC;gBACvC,SAAS,EAAE,IAAI,CAAC,cAAc;gBAC9B,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU;aACX,CAAC;YACF,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,yBAAyB,CAAC;YAC7C,kBAAkB;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,GAAG;YACH,UAAU;YACV,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,yEAAyE;YACzE,mDAAmD;YACnD,oBAAoB,EAAE,IAAI,6BAA6B,EAAE;YACzD,SAAS;YACT,eAAe;YACf,mBAAmB;YACnB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.d.ts

@@ -0,0 +1,34 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLogsLogGroup } from "../../group/sim-logs-log-group.js";
+import type { SimLogs } from "../../sim-logs.js";
+interface SimCfnLogGroupCreatorProperties {
+    readonly logs: SimLogs;
+}
+/**
+ * Creates simulated log groups from AWS::Logs::LogGroup Resources.
+ *
+ * A declared log group and one a Lambda function made for itself are the same
+ * thing, which is why creating one that is already there is not an error here
+ * the way `CreateLogGroup` is. A template naming `/aws/lambda/orders` is
+ * usually saying what retention that function's logs should have, and it is
+ * ordinary for the function to have logged first: real CloudFormation fails
+ * that deploy, which is a genuine misconfiguration in an account and pure
+ * noise in a test whose function ran during setup.
+ */
+export declare class SimCfnLogGroupCreator {
+    #private;
+    constructor(properties: SimCfnLogGroupCreatorProperties);
+    /**
+     * Create a log group from an AWS::Logs::LogGroup Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimLogsLogGroup;
+    /**
+     * Delete a log group created from an AWS::Logs::LogGroup Resource.
+     *
+     * The events go with it, as they do in an account.
+     */
+    delete(group: SimLogsLogGroup): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-log-group-creator.d.ts.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;;IAGhC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,eAAe,CAejB;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAEnC;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.js

@@ -0,0 +1,42 @@
+import { SimCfnLogGroupProperties } from "./sim-cfn-log-group-properties.js";
+/**
+ * Creates simulated log groups from AWS::Logs::LogGroup Resources.
+ *
+ * A declared log group and one a Lambda function made for itself are the same
+ * thing, which is why creating one that is already there is not an error here
+ * the way `CreateLogGroup` is. A template naming `/aws/lambda/orders` is
+ * usually saying what retention that function's logs should have, and it is
+ * ordinary for the function to have logged first: real CloudFormation fails
+ * that deploy, which is a genuine misconfiguration in an account and pure
+ * noise in a test whose function ran during setup.
+ */
+export class SimCfnLogGroupCreator {
+    #logs;
+    constructor(properties) {
+        this.#logs = properties.logs;
+    }
+    /**
+     * Create a log group from an AWS::Logs::LogGroup Resource.
+     */
+    create(resource, properties) {
+        const logGroupProperties = new SimCfnLogGroupProperties({
+            resource,
+            properties,
+        });
+        const logGroupName = logGroupProperties.logGroupName();
+        const retentionInDays = logGroupProperties.retentionInDays();
+        logGroupProperties.recordIgnoredProperties();
+        const group = this.#logs.serviceWriter().logGroup(logGroupName);
+        group.setRetention(retentionInDays);
+        return group;
+    }
+    /**
+     * Delete a log group created from an AWS::Logs::LogGroup Resource.
+     *
+     * The events go with it, as they do in an account.
+     */
+    delete(group) {
+        this.#logs.serviceWriter().deleteLogGroup(group.logGroupName);
+    }
+}
+//# sourceMappingURL=sim-cfn-log-group-creator.js.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-creator.js","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAM7E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACvB,KAAK,CAAU;IAExB,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAwB,EACxB,UAAqC;QAErC,MAAM,kBAAkB,GAAG,IAAI,wBAAwB,CAAC;YACtD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,eAAe,GAAG,kBAAkB,CAAC,eAAe,EAAE,CAAC;QAE7D,kBAAkB,CAAC,uBAAuB,EAAE,CAAC;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEhE,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QAEpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAsB;QAC3B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-properties.d.ts

@@ -0,0 +1,41 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * A refusal naming the Resource whose properties could not be read.
+ */
+export declare function logGroupPropertyError(logicalId: string, reason: string): Error;
+interface SimCfnLogGroupPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Reads AWS::Logs::LogGroup CloudFormation properties.
+ */
+export declare class SimCfnLogGroupProperties {
+    #private;
+    constructor(properties: SimCfnLogGroupPropertiesProperties);
+    /**
+     * The log group name.
+     *
+     * An unnamed log group is named after the stack and the logical ID, as real
+     * CloudFormation names one. Nothing lower cases it, unlike a repository
+     * name: a log group name keeps whatever case it was given.
+     */
+    logGroupName(): string;
+    /**
+     * How long the log group keeps its events, or undefined where the template
+     * sets no retention and they are kept forever.
+     *
+     * A value outside the set real CloudWatch Logs accepts fails the Resource.
+     * That is the mistake this property exists to catch: `RetentionInDays: 10`
+     * looks reasonable, is refused by an account, and would otherwise only be
+     * found on a real deploy.
+     */
+    retentionInDays(): number | undefined;
+    /**
+     * Record the properties the log group is created without acting on.
+     */
+    recordIgnoredProperties(): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-log-group-properties.d.ts.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-properties.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAMlH;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,KAAK,CAIP;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;GAEG;AACH,qBAAa,wBAAwB;;IAKnC,YAAY,UAAU,EAAE,kCAAkC,EAOzD;IAED;;;;;;OAMG;IACH,YAAY,IAAI,MAAM,CAmBrB;IAED;;;;;;;;OAQG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS,CAepC;IAED;;OAEG;IACH,uBAAuB,IAAI,IAAI,CAE9B;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-properties.js

@@ -0,0 +1,73 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { requiredSimLogsRetentionDays } from "../../group/sim-logs-retention.js";
+import { SimCfnLogGroupPropertyRules } from "./sim-cfn-log-group-property-rules.js";
+const maximumNameLength = 512;
+/**
+ * A refusal naming the Resource whose properties could not be read.
+ */
+export function logGroupPropertyError(logicalId, reason) {
+    return new Error(`Invalid sim CloudWatch Logs CloudFormation Resource ${logicalId}: ${reason}`);
+}
+/**
+ * Reads AWS::Logs::LogGroup CloudFormation properties.
+ */
+export class SimCfnLogGroupProperties {
+    #resource;
+    #properties;
+    #rules;
+    constructor(properties) {
+        this.#resource = properties.resource;
+        this.#properties = properties.properties;
+        this.#rules = new SimCfnLogGroupPropertyRules({
+            properties: properties.properties,
+            ignorer: properties.resource,
+        });
+    }
+    /**
+     * The log group name.
+     *
+     * An unnamed log group is named after the stack and the logical ID, as real
+     * CloudFormation names one. Nothing lower cases it, unlike a repository
+     * name: a log group name keeps whatever case it was given.
+     */
+    logGroupName() {
+        const name = this.#properties["LogGroupName"];
+        if (name === undefined) {
+            return new SimCfnGeneratedResourceName({
+                stackName: this.#resource.stackName,
+                logicalId: this.#resource.logicalId,
+                maximumLength: maximumNameLength,
+            }).value;
+        }
+        if (typeof name !== "string") {
+            throw logGroupPropertyError(this.#resource.logicalId, "LogGroupName must be a string");
+        }
+        return name;
+    }
+    /**
+     * How long the log group keeps its events, or undefined where the template
+     * sets no retention and they are kept forever.
+     *
+     * A value outside the set real CloudWatch Logs accepts fails the Resource.
+     * That is the mistake this property exists to catch: `RetentionInDays: 10`
+     * looks reasonable, is refused by an account, and would otherwise only be
+     * found on a real deploy.
+     */
+    retentionInDays() {
+        const retention = this.#properties["RetentionInDays"];
+        if (retention === undefined) {
+            return undefined;
+        }
+        if (typeof retention !== "number") {
+            throw logGroupPropertyError(this.#resource.logicalId, "RetentionInDays must be a number");
+        }
+        return requiredSimLogsRetentionDays(retention);
+    }
+    /**
+     * Record the properties the log group is created without acting on.
+     */
+    recordIgnoredProperties() {
+        this.#rules.apply();
+    }
+}
+//# sourceMappingURL=sim-cfn-log-group-properties.js.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-properties.js","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-properties.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0EAA0E,CAAC;AAGvH,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEpF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,MAAc;IAEd,OAAO,IAAI,KAAK,CACd,uDAAuD,SAAS,KAAK,MAAM,EAAE,CAC9E,CAAC;AACJ,CAAC;AAOD;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAAiB;IAC1B,WAAW,CAA4B;IACvC,MAAM,CAA8B;IAE7C,YAAY,UAA8C;QACxD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC;YAC5C,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,2BAA2B,CAAC;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;gBACnC,aAAa,EAAE,iBAAiB;aACjC,CAAC,CAAC,KAAK,CAAC;QACX,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,qBAAqB,CACzB,IAAI,CAAC,SAAS,CAAC,SAAS,EACxB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAEtD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,qBAAqB,CACzB,IAAI,CAAC,SAAS,CAAC,SAAS,EACxB,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-property-rules.d.ts

@@ -0,0 +1,25 @@
+import type { SimCfnPropertyIgnorer } from "../../../cloudformation/resource/ignore/sim-cfn-ignored-property.type.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnLogGroupPropertyRulesProperties {
+    readonly properties: SimCfnTemplateValueRecord;
+    readonly ignorer: SimCfnPropertyIgnorer;
+}
+/**
+ * What a log group Resource is created without acting on.
+ *
+ * The name and the retention are the two properties this simulation reads,
+ * because they are the two a test asserts on. Everything else, whether
+ * CloudWatch Logs has it or not, is recorded so a reader can see what a
+ * deployed log group is not doing.
+ */
+export declare class SimCfnLogGroupPropertyRules {
+    #private;
+    constructor(properties: SimCfnLogGroupPropertyRulesProperties);
+    /**
+     * Record every property the log group is created without.
+     */
+    apply(): void;
+    private applyToProperty;
+}
+export {};
+//# sourceMappingURL=sim-cfn-log-group-property-rules.d.ts.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-property-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-property-rules.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-property-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0EAA0E,CAAC;AACtH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAMlH,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA2B;;IAItC,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,KAAK,IAAI,IAAI,CAIZ;IAED,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-property-rules.js

@@ -0,0 +1,41 @@
+import { unsimulatedPropertyReasons } from "./sim-cfn-log-group-unsimulated-properties.js";
+/** The properties a log group Resource is actually created from. */
+const actedOnProperties = new Set(["LogGroupName", "RetentionInDays"]);
+/**
+ * What a log group Resource is created without acting on.
+ *
+ * The name and the retention are the two properties this simulation reads,
+ * because they are the two a test asserts on. Everything else, whether
+ * CloudWatch Logs has it or not, is recorded so a reader can see what a
+ * deployed log group is not doing.
+ */
+export class SimCfnLogGroupPropertyRules {
+    #properties;
+    #ignorer;
+    constructor(properties) {
+        this.#properties = properties.properties;
+        this.#ignorer = properties.ignorer;
+    }
+    /**
+     * Record every property the log group is created without.
+     */
+    apply() {
+        for (const name of Object.keys(this.#properties)) {
+            this.applyToProperty(name);
+        }
+    }
+    applyToProperty(name) {
+        if (actedOnProperties.has(name)) {
+            return;
+        }
+        const unsimulatedReason = unsimulatedPropertyReasons.get(name);
+        if (unsimulatedReason === undefined) {
+            this.#ignorer.ignoreProperty(name, `${name} is not a property simulated CloudWatch Logs knows about, so ` +
+                `the log group is created without it`);
+            return;
+        }
+        this.#ignorer.ignoreProperty(name, `${name} is a real AWS::Logs::LogGroup property simulated CloudWatch ` +
+            `Logs does not act on: ${unsimulatedReason}`);
+    }
+}
+//# sourceMappingURL=sim-cfn-log-group-property-rules.js.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-property-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-property-rules.js","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-property-rules.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAE3F,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAOvE;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IAC7B,WAAW,CAA4B;IACvC,QAAQ,CAAwB;IAEzC,YAAY,UAAiD;QAC3D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE/D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAC1B,IAAI,EACJ,GAAG,IAAI,+DAA+D;gBACpE,qCAAqC,CACxC,CAAC;YAEF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAC1B,IAAI,EACJ,GAAG,IAAI,+DAA+D;YACpE,yBAAyB,iBAAiB,EAAE,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The AWS::Logs::LogGroup properties this simulation has nothing to act on,
+ * and why.
+ *
+ * They are recorded as ignored rather than refused, because a log group
+ * without any of them still does the one thing a log group does here: hold the
+ * events written to it, under a name and with a retention a test can assert
+ * on. Refusing would take a whole stack down over a property that changes
+ * nothing about what the test is checking.
+ */
+export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+//# sourceMappingURL=sim-cfn-log-group-unsimulated-properties.d.ts.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-unsimulated-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA0BjE,CAAC"}

package/dist/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.js

@@ -0,0 +1,38 @@
+/**
+ * The AWS::Logs::LogGroup properties this simulation has nothing to act on,
+ * and why.
+ *
+ * They are recorded as ignored rather than refused, because a log group
+ * without any of them still does the one thing a log group does here: hold the
+ * events written to it, under a name and with a retention a test can assert
+ * on. Refusing would take a whole stack down over a property that changes
+ * nothing about what the test is checking.
+ */
+export const unsimulatedPropertyReasons = new Map([
+    [
+        "KmsKeyId",
+        "log group encryption is not simulated, so events are held in this " +
+            "process either way and no key is ever used",
+    ],
+    [
+        "DataProtectionPolicy",
+        "data protection is not simulated, so nothing masks or audits a value an " +
+            "event carries",
+    ],
+    [
+        "FieldIndexPolicies",
+        "field indexes only change how Logs Insights queries are served, and " +
+            "there are no Logs Insights queries here",
+    ],
+    [
+        "Tags",
+        "log group tags are not simulated, so nothing reads them back and " +
+            "nothing is billed or grouped by them",
+    ],
+    [
+        "LogGroupClass",
+        "only the standard class is simulated, which is what every operation " +
+            "here behaves as",
+    ],
+]);
+//# sourceMappingURL=sim-cfn-log-group-unsimulated-properties.js.map

package/dist/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-log-group-unsimulated-properties.js","sourceRoot":"","sources":["../../../../../src/service/logs/cfn/group/sim-cfn-log-group-unsimulated-properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAgC,IAAI,GAAG,CAAC;IAC7E;QACE,UAAU;QACV,oEAAoE;YAClE,4CAA4C;KAC/C;IACD;QACE,sBAAsB;QACtB,0EAA0E;YACxE,eAAe;KAClB;IACD;QACE,oBAAoB;QACpB,sEAAsE;YACpE,yCAAyC;KAC5C;IACD;QACE,MAAM;QACN,mEAAmE;YACjE,sCAAsC;KACzC;IACD;QACE,eAAe;QACf,sEAAsE;YACpE,iBAAiB;KACpB;CACF,CAAC,CAAC"}

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.d.ts

@@ -0,0 +1,29 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimLogs } from "../sim-logs.js";
+interface SimLogsCfnResourceFactoryProperties {
+    readonly logs: SimLogs;
+}
+/**
+ * CloudFormation Resource factory for simulated CloudWatch Logs resources.
+ *
+ * AWS::Logs::LogGroup is the only Resource type here so far. The others,
+ * subscription filters and metric filters most of all, need machinery this
+ * simulation does not have yet.
+ */
+export declare class SimLogsCfnResourceFactory implements SimCfnServiceResourceFactory {
+    #private;
+    constructor(properties: SimLogsCfnResourceFactoryProperties);
+    /**
+     * Create a simulated CloudWatch Logs resource from a CloudFormation
+     * Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Delete a simulated CloudWatch Logs resource created from a CloudFormation
+     * Resource.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-logs-cfn-resource-factory.d.ts.map

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-cfn-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/logs/cfn/sim-logs-cfn-resource-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAK9C,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,qBAAa,yBAA0B,YAAW,4BAA4B;;IAG5E,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;;OAGG;IACH,MAAM,CACJ,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B;IAED;;;OAGG;IACH,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;CACF"}

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.js

@@ -0,0 +1,44 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { SimCfnLogGroupCreator } from "./group/sim-cfn-log-group-creator.js";
+const logGroupResourceTypeName = "LogGroup";
+/**
+ * CloudFormation Resource factory for simulated CloudWatch Logs resources.
+ *
+ * AWS::Logs::LogGroup is the only Resource type here so far. The others,
+ * subscription filters and metric filters most of all, need machinery this
+ * simulation does not have yet.
+ */
+export class SimLogsCfnResourceFactory {
+    #logGroupCreator;
+    constructor(properties) {
+        this.#logGroupCreator = new SimCfnLogGroupCreator({
+            logs: properties.logs,
+        });
+    }
+    /**
+     * Create a simulated CloudWatch Logs resource from a CloudFormation
+     * Resource.
+     */
+    create(resourceTypeName, resource, context) {
+        requireLogGroupResourceType(resourceTypeName, "");
+        return Promise.resolve(this.#logGroupCreator.create(resource, context.resolvedProperties ?? resource.properties));
+    }
+    /**
+     * Delete a simulated CloudWatch Logs resource created from a CloudFormation
+     * Resource.
+     */
+    delete(resourceTypeName, resource) {
+        requireLogGroupResourceType(resourceTypeName, " deletion");
+        const group = resource.simResource;
+        assertDefined(group, `sim CloudWatch Logs log group for CloudFormation Resource ${resource.logicalId}`);
+        this.#logGroupCreator.delete(group);
+        return Promise.resolve();
+    }
+}
+function requireLogGroupResourceType(resourceTypeName, operationSuffix) {
+    if (resourceTypeName !== logGroupResourceTypeName) {
+        throw new Error(`Unsupported sim CloudWatch Logs CloudFormation Resource ` +
+            `${resourceTypeName}${operationSuffix}`);
+    }
+}
+//# sourceMappingURL=sim-logs-cfn-resource-factory.js.map

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-cfn-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/logs/cfn/sim-logs-cfn-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAM5C;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAC3B,gBAAgB,CAAwB;IAEjD,YAAY,UAA+C;QACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,qBAAqB,CAAC;YAChD,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,2BAA2B,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAElD,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC1B,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,gBAAwB,EAAE,QAAwB;QACvD,2BAA2B,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAA0C,CAAC;QAElE,aAAa,CACX,KAAK,EACL,6DAA6D,QAAQ,CAAC,SAAS,EAAE,CAClF,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,2BAA2B,CAClC,gBAAwB,EACxB,eAAuB;IAEvB,IAAI,gBAAgB,KAAK,wBAAwB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,0DAA0D;YACxD,GAAG,gBAAgB,GAAG,eAAe,EAAE,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/logs/command/authorize/sim-logs-authorizer.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface SimLogsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to CloudWatch Logs requests.
+ *
+ * An operation on one log group authorizes against that group's ARN with the
+ * trailing `:*`, which is the form CloudWatch Logs policies are written in:
+ * granting a function permission to write its own logs grants it on the
+ * streams inside the group, and the wildcard is what covers them. A policy
+ * naming `log-group:/aws/lambda/orders` without it therefore reaches nothing
+ * here, exactly as it reaches nothing on real AWS.
+ */
+export declare class SimLogsAuthorizer {
+    #private;
+    constructor(properties: SimLogsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a log group.
+     *
+     * The group need not exist. Real IAM evaluates a request before the service
+     * handles it, so a caller with no permission is refused whether or not the
+     * group is there, and CreateLogGroup authorizes against the ARN the group is
+     * about to have.
+     */
+    authorizeLogGroup(action: string, logGroupName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may perform an action that names no particular log
+     * group, such as describing them all.
+     *
+     * The resource is every log group in this account and region, which is what
+     * such a request actually reaches. A policy scoped to one group does not
+     * cover it, and one written against `*` or the log group wildcard does.
+     */
+    authorizeAnyLogGroup(action: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    private authorizeResource;
+}
+export {};
+//# sourceMappingURL=sim-logs-authorizer.d.ts.map

package/dist/service/logs/command/authorize/sim-logs-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/command/authorize/sim-logs-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAOtG,UAAU,2BAA2B;IACnC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;;IAI5B,YAAY,UAAU,EAAE,2BAA2B,EAGlD;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,YAAY,GACpB,oBAAoB,CAMtB;IAED;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,YAAY,GACpB,oBAAoB,CAMtB;IAED,OAAO,CAAC,iBAAiB;CAiB1B"}

package/dist/service/logs/command/authorize/sim-logs-authorizer.js

@@ -0,0 +1,54 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simLogsAnyLogGroupArn, simLogsLogGroupWildcardArn, } from "../../group/sim-logs-arn.js";
+/**
+ * Applies simulated IAM authorization to CloudWatch Logs requests.
+ *
+ * An operation on one log group authorizes against that group's ARN with the
+ * trailing `:*`, which is the form CloudWatch Logs policies are written in:
+ * granting a function permission to write its own logs grants it on the
+ * streams inside the group, and the wildcard is what covers them. A policy
+ * naming `log-group:/aws/lambda/orders` without it therefore reaches nothing
+ * here, exactly as it reaches nothing on real AWS.
+ */
+export class SimLogsAuthorizer {
+    #iam;
+    #accountRegionScope;
+    constructor(properties) {
+        this.#iam = properties.iam;
+        this.#accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Ensure the caller may perform an action on a log group.
+     *
+     * The group need not exist. Real IAM evaluates a request before the service
+     * handles it, so a caller with no permission is refused whether or not the
+     * group is there, and CreateLogGroup authorizes against the ARN the group is
+     * about to have.
+     */
+    authorizeLogGroup(action, logGroupName, caller) {
+        return this.authorizeResource(action, simLogsLogGroupWildcardArn(this.#accountRegionScope, logGroupName), caller);
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular log
+     * group, such as describing them all.
+     *
+     * The resource is every log group in this account and region, which is what
+     * such a request actually reaches. A policy scoped to one group does not
+     * cover it, and one written against `*` or the log group wildcard does.
+     */
+    authorizeAnyLogGroup(action, caller) {
+        return this.authorizeResource(action, simLogsAnyLogGroupArn(this.#accountRegionScope), caller);
+    }
+    authorizeResource(action, resource, caller) {
+        const decision = this.#iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+        return decision.caller;
+    }
+}
+//# sourceMappingURL=sim-logs-authorizer.js.map

package/dist/service/logs/command/authorize/sim-logs-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/logs/command/authorize/sim-logs-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AAOrC;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAiB;IACnB,IAAI,CAA0B;IAC9B,mBAAmB,CAA2B;IAEvD,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,MAAc,EACd,YAAoB,EACpB,MAAqB;QAErB,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAClE,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAc,EACd,MAAqB;QAErB,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAC/C,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,iBAAiB,CACvB,MAAc,EACd,QAAgB,EAChB,MAAgC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF"}