@kensio/yulin 1.17.0 → 1.17.1

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IAE7B,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,UAAU;gBACtB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CACH,CACF,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,+BAA+B,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,oCAAoC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,mCAAmC,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,iCAAiC,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,IAAI;oBAChD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AAMnD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IACZ,WAAW,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAErE,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;SACvC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts

@@ -0,0 +1,38 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+export interface SimCfnIamPolicyProperties {
+    readonly policyName: string;
+    readonly policyDocument: string;
+    readonly roleNames: readonly string[];
+    readonly usernames: readonly string[];
+}
+/**
+ * Parses and validates AWS::IAM::Policy CloudFormation properties into the
+ * shape the sim IAM inline policy creator needs.
+ *
+ * Keeping the property-shape validation here keeps the creator focused on
+ * orchestrating IAM command calls.
+ */
+export declare class SimCfnIamPolicyPropertiesParser {
+    /**
+     * Parse the resolved CloudFormation properties for an AWS::IAM::Policy.
+     */
+    parse(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnIamPolicyProperties;
+    private policyName;
+    private policyDocument;
+    /**
+     * The principal names one property attaches the policy to. Role and User
+     * Refs are resolved to names before creation, so entries arrive as plain
+     * strings. An absent property is not an error on its own, because a policy
+     * naming only the other kind of principal is the usual CDK shape.
+     */
+    private principalNames;
+    /**
+     * IAM Groups are not simulated as CloudFormation policy principals, and
+     * silently dropping a grant would be misleading, so their presence fails
+     * creation.
+     */
+    private rejectGroups;
+    private invalid;
+}
+//# sourceMappingURL=sim-cfn-iam-policy-properties-parser.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAMD;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,yBAAyB,CAmB3B;IAED,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAiBtB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,OAAO;CAKhB"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.js

@@ -0,0 +1,79 @@
+const resourceType = "AWS::IAM::Policy";
+/**
+ * Parses and validates AWS::IAM::Policy CloudFormation properties into the
+ * shape the sim IAM inline policy creator needs.
+ *
+ * Keeping the property-shape validation here keeps the creator focused on
+ * orchestrating IAM command calls.
+ */
+export class SimCfnIamPolicyPropertiesParser {
+    /**
+     * Parse the resolved CloudFormation properties for an AWS::IAM::Policy.
+     */
+    parse(resource, properties) {
+        this.rejectGroups(resource, properties);
+        const roleNames = this.principalNames(resource, properties, "Roles");
+        const usernames = this.principalNames(resource, properties, "Users");
+        if (roleNames.length === 0 && usernames.length === 0) {
+            throw this.invalid(resource, "Roles or Users must name at least one principal");
+        }
+        return {
+            policyName: this.policyName(resource, properties),
+            policyDocument: this.policyDocument(resource, properties),
+            roleNames,
+            usernames,
+        };
+    }
+    policyName(resource, properties) {
+        const policyName = properties["PolicyName"];
+        if (typeof policyName !== "string") {
+            throw this.invalid(resource, "PolicyName must be a string");
+        }
+        return policyName;
+    }
+    policyDocument(resource, properties) {
+        const policyDocument = properties["PolicyDocument"];
+        if (typeof policyDocument !== "object" ||
+            policyDocument === null ||
+            Array.isArray(policyDocument)) {
+            throw this.invalid(resource, "PolicyDocument must be an object");
+        }
+        return JSON.stringify(policyDocument);
+    }
+    /**
+     * The principal names one property attaches the policy to. Role and User
+     * Refs are resolved to names before creation, so entries arrive as plain
+     * strings. An absent property is not an error on its own, because a policy
+     * naming only the other kind of principal is the usual CDK shape.
+     */
+    principalNames(resource, properties, property) {
+        // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
+        const principals = properties[property];
+        if (principals === undefined) {
+            return [];
+        }
+        if (!Array.isArray(principals)) {
+            throw this.invalid(resource, `${property} must be an array`);
+        }
+        return principals.map((name) => {
+            if (typeof name !== "string") {
+                throw this.invalid(resource, `${property} entries must be strings`);
+            }
+            return name;
+        });
+    }
+    /**
+     * IAM Groups are not simulated as CloudFormation policy principals, and
+     * silently dropping a grant would be misleading, so their presence fails
+     * creation.
+     */
+    rejectGroups(resource, properties) {
+        if (properties["Groups"] !== undefined) {
+            throw this.invalid(resource, "Groups are not simulated");
+        }
+    }
+    invalid(resource, reason) {
+        return new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${reason}`);
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-policy-properties-parser.js.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.ts"],"names":[],"mappings":"AAYA,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAErE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,OAAO,CAChB,QAAQ,EACR,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YACjD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACzD,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACK,cAAc,CACpB,QAAwB,EACxB,UAAqC,EACrC,QAA0C;QAE1C,qFAAqF;QACrF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,0BAA0B,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAClB,QAAwB,EACxB,UAAqC;QAErC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,QAAwB,EAAE,MAAc;QACtD,OAAO,IAAI,SAAS,CAClB,WAAW,YAAY,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAC3D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts

@@ -1,12 +1,12 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
-import { type SimCfnIamRoleInlinePolicy } from "./sim-cfn-iam-role-policies-parser.js";
+import { type SimCfnIamInlinePolicy } from "../sim-cfn-iam-policies-parser.js";
 export interface SimCfnIamRoleProperties {
     readonly roleName: string;
     readonly path: string | undefined;
     readonly description: string | undefined;
     readonly assumeRolePolicyDocument: string;
-    readonly inlinePolicies: readonly SimCfnIamRoleInlinePolicy[];
+    readonly inlinePolicies: readonly SimCfnIamInlinePolicy[];
     readonly managedPolicyArns: readonly string[];
 }
 /**

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-role-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAC;AAE/C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IAEpE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,uBAAuB,CAsBzB;IAED,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,UAAU;CAanB"}
+{"version":3,"file":"sim-cfn-iam-role-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE5B;IAEH;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,uBAAuB,CAsBzB;IAED,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,UAAU;CAanB"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,4 +1,4 @@
-import { SimCfnIamRolePoliciesParser, } from "./sim-cfn-iam-role-policies-parser.js";
+import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
  * the sim IAM Role creator needs.
@@ -7,7 +7,9 @@ import { SimCfnIamRolePoliciesParser, } from "./sim-cfn-iam-role-policies-parser
  * orchestrating IAM command calls.
  */
 export class SimCfnIamRolePropertiesParser {
-    policiesParser = new SimCfnIamRolePoliciesParser();
+    policiesParser = new SimCfnIamPoliciesParser({
+        resourceType: "AWS::IAM::Role",
+    });
     /**
      * Parse the resolved CloudFormation properties for an AWS::IAM::Role.
      */

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-role-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,2BAA2B,GAE5B,MAAM,uCAAuC,CAAC;AAW/C;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,cAAc,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEpE;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,QAAQ,EACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBACjE,QAAQ,CAAC,SAAS;YACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,cAAc,CAC9B,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,wBAAwB,EAAE,IAAI,CAAC,UAAU,CACvC,QAAQ,EACR,UAAU,CAAC,0BAA0B,CAAC,EACtC,0BAA0B,CAC3B;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACtD,QAAQ,EACR,UAAU,CACX;SACF,CAAC;IACJ,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,oBAAoB,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-role-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,uBAAuB,GAExB,MAAM,mCAAmC,CAAC;AAW3C;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,cAAc,GAAG,IAAI,uBAAuB,CAAC;QAC5D,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,QAAQ,EACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBACjE,QAAQ,CAAC,SAAS;YACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,cAAc,CAC9B,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,wBAAwB,EAAE,IAAI,CAAC,UAAU,CACvC,QAAQ,EACR,UAAU,CAAC,0BAA0B,CAAC,EACtC,0BAA0B,CAC3B;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACtD,QAAQ,EACR,UAAU,CACX;SACF,CAAC;IACJ,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,oBAAoB,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/iam/cfn/sim-cfn-iam-policies-parser.d.ts

@@ -0,0 +1,35 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+export interface SimCfnIamInlinePolicy {
+    readonly policyName: string;
+    readonly policyDocument: string;
+}
+interface SimCfnIamPoliciesParserProperties {
+    /**
+     * The Resource type being parsed, for error messages.
+     */
+    readonly resourceType: string;
+}
+/**
+ * Parses the policy collection properties an IAM identity Resource carries:
+ * the inline `Policies` list and the attached `ManagedPolicyArns` list.
+ *
+ * AWS::IAM::Role and AWS::IAM::User declare both in the same shape, and these
+ * list-shaped properties carry the bulk of the property validation, so
+ * grouping them here keeps each identity's own props parser small.
+ */
+export declare class SimCfnIamPoliciesParser {
+    private readonly resourceType;
+    constructor(properties: SimCfnIamPoliciesParserProperties);
+    /**
+     * Parse the inline `Policies` property into normalised inline policies.
+     */
+    inlinePolicies(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly SimCfnIamInlinePolicy[];
+    /**
+     * Parse the attached `ManagedPolicyArns` property into policy ARN strings.
+     */
+    managedPolicyArns(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly string[];
+    private inlinePolicy;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-policies-parser.d.ts.map

package/dist/service/iam/cfn/sim-cfn-iam-policies-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policies-parser.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-policies-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAE/G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,iCAAiC;IACzC;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,qBAAqB,EAAE,CAclC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,MAAM,EAAE,CAsBnB;IAED,OAAO,CAAC,YAAY;CAuCrB"}

package/dist/service/iam/cfn/{role/sim-cfn-iam-role-policies-parser.js → sim-cfn-iam-policies-parser.js}

@@ -1,11 +1,16 @@
 /**
- * Parses the AWS::IAM::Role policy collection properties: the inline `Policies`
- * list and the attached `ManagedPolicyArns` list.
+ * Parses the policy collection properties an IAM identity Resource carries:
+ * the inline `Policies` list and the attached `ManagedPolicyArns` list.
  *
- * These list-shaped properties carry the bulk of the Role property validation,
- * so grouping them here keeps the main Role props parser small.
+ * AWS::IAM::Role and AWS::IAM::User declare both in the same shape, and these
+ * list-shaped properties carry the bulk of the property validation, so
+ * grouping them here keeps each identity's own props parser small.
  */
-export class SimCfnIamRolePoliciesParser {
+export class SimCfnIamPoliciesParser {
+    resourceType;
+    constructor(properties) {
+        this.resourceType = properties.resourceType;
+    }
     /**
      * Parse the inline `Policies` property into normalised inline policies.
      */
@@ -15,7 +20,7 @@ export class SimCfnIamRolePoliciesParser {
             return [];
         }
         if (!Array.isArray(policies)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies must be an array`);
+            throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: Policies must be an array`);
         }
         return policies.map((policy) => this.inlinePolicy(resource, policy));
     }
@@ -28,11 +33,11 @@ export class SimCfnIamRolePoliciesParser {
             return [];
         }
         if (!Array.isArray(managedPolicyArns)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ManagedPolicyArns must be an array`);
+            throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: ManagedPolicyArns must be an array`);
         }
         return managedPolicyArns.map((arn) => {
             if (typeof arn !== "string") {
-                throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: each ManagedPolicyArns entry must be a string`);
+                throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: each ManagedPolicyArns entry must be a string`);
             }
             return arn;
         });
@@ -41,17 +46,17 @@ export class SimCfnIamRolePoliciesParser {
         if (typeof policy !== "object" ||
             policy === null ||
             Array.isArray(policy)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: each Policies entry must be an object`);
+            throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: each Policies entry must be an object`);
         }
         const policyName = policy["PolicyName"];
         if (typeof policyName !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies entry PolicyName must be a string`);
+            throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: Policies entry PolicyName must be a string`);
         }
         const policyDocument = policy["PolicyDocument"];
         if (typeof policyDocument !== "object" ||
             policyDocument === null ||
             Array.isArray(policyDocument)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies entry PolicyDocument must be an object`);
+            throw new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: Policies entry PolicyDocument must be an object`);
         }
         return {
             policyName,
@@ -59,4 +64,4 @@ export class SimCfnIamRolePoliciesParser {
         };
     }
 }
-//# sourceMappingURL=sim-cfn-iam-role-policies-parser.js.map
+//# sourceMappingURL=sim-cfn-iam-policies-parser.js.map

package/dist/service/iam/cfn/sim-cfn-iam-policies-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policies-parser.js","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-policies-parser.ts"],"names":[],"mappings":"AAeA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,YAAY,CAAS;IAEtC,YAAY,UAA6C;QACvD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,UAAqC;QAErC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,6BAA6B,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,sCAAsC,CACzF,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,iDAAiD,CACpG,CAAC;YACJ,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,QAAwB,EACxB,MAAqD;QAErD,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,yCAAyC,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAExC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,8CAA8C,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,mDAAmD,CACtG,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.d.ts

@@ -10,12 +10,23 @@ interface SimCfnIamResourceDeleterProperties {
 export declare class SimCfnIamResourceDeleter {
     private readonly iam;
     private readonly roleDeleter;
+    private readonly userDeleter;
     constructor(properties: SimCfnIamResourceDeleterProperties);
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
     delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
     private deleteManagedPolicy;
+    /**
+     * Take the Managed Policy off every Role still carrying it.
+     *
+     * DeletePolicy refuses a policy anything is attached to, and an
+     * AWS::IAM::ManagedPolicy attaches itself to the Roles its `Roles` property
+     * names. A Role the same Stack created gives the policy up as its own
+     * Resource is deleted. A Role declared outside the Stack keeps it. This
+     * clears whatever attachments are left either way.
+     */
+    private detachManagedPolicy;
     /**
      * Take an AWS::IAM::Policy back off the Roles it was put on.
      *

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-resource-deleter.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-deleter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAK5C,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IAEnD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAoBf;YAEa,mBAAmB;IAUjC;;;;;;OAMG;YACW,kBAAkB;CAqBjC"}
+{"version":3,"file":"sim-cfn-iam-resource-deleter.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-deleter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAM5C,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IAEnD,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAwBf;YAEa,mBAAmB;IAWjC;;;;;;;;OAQG;YACW,mBAAmB;IAajC;;;;;;OAMG;YACW,kBAAkB;CAqBjC"}

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.js

@@ -1,4 +1,5 @@
 import { SimCfnIamRoleDeleter } from "./role/sim-cfn-iam-role-deleter.js";
+import { SimCfnIamUserDeleter } from "./user/sim-cfn-iam-user-deleter.js";
 import { assertDefined } from "../../../util/type-guard/defined.js";
 /**
  * Deletes the simulated IAM resources a CloudFormation Stack created.
@@ -6,9 +7,11 @@ import { assertDefined } from "../../../util/type-guard/defined.js";
 export class SimCfnIamResourceDeleter {
     iam;
     roleDeleter;
+    userDeleter;
     constructor(properties) {
         this.iam = properties.iam;
         this.roleDeleter = new SimCfnIamRoleDeleter({ iam: properties.iam });
+        this.userDeleter = new SimCfnIamUserDeleter({ iam: properties.iam });
     }
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
@@ -27,6 +30,10 @@ export class SimCfnIamResourceDeleter {
                 await this.roleDeleter.delete(resource);
                 return;
             }
+            case "User": {
+                await this.userDeleter.delete(resource);
+                return;
+            }
             default: {
                 throw new Error(`Unsupported sim IAM CloudFormation Resource ${resourceTypeName} deletion`);
             }
@@ -35,8 +42,26 @@ export class SimCfnIamResourceDeleter {
     async deleteManagedPolicy(resource) {
         const policy = resource.simResource;
         assertDefined(policy, `sim IAM Managed Policy for CloudFormation Resource ${resource.logicalId}`);
+        await this.detachManagedPolicy(policy.arn);
         await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } });
     }
+    /**
+     * Take the Managed Policy off every Role still carrying it.
+     *
+     * DeletePolicy refuses a policy anything is attached to, and an
+     * AWS::IAM::ManagedPolicy attaches itself to the Roles its `Roles` property
+     * names. A Role the same Stack created gives the policy up as its own
+     * Resource is deleted. A Role declared outside the Stack keeps it. This
+     * clears whatever attachments are left either way.
+     */
+    async detachManagedPolicy(policyArn) {
+        await Promise.all(this.iam.roles
+            .values()
+            .filter((role) => role.attachedPolicyArns.has(policyArn))
+            .map(async (role) => this.iam.detachRolePolicy({
+            input: { RoleName: role.roleName, PolicyArn: policyArn },
+        })));
+    }
     /**
      * Take an AWS::IAM::Policy back off the Roles it was put on.
      *

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-resource-deleter.js","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-deleter.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMpE;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAClB,GAAG,CAAS;IACZ,WAAW,CAAuB;IAEnD,YAAY,UAA8C;QACxD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,UAAqC;QAErC,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,WAAW,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAwB;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAA8C,CAAC;QACvE,aAAa,CACX,MAAM,EACN,sDAAsD,QAAQ,CAAC,SAAS,EAAE,CAC3E,CAAC;QAEF,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAC9B,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,yEAAyE;QACzE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK;aACF,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC;aACtE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACtB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;SACtD,CAAC,CACH,CACJ,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-resource-deleter.js","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-deleter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMpE;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAClB,GAAG,CAAS;IACZ,WAAW,CAAuB;IAClC,WAAW,CAAuB;IAEnD,YAAY,UAA8C;QACxD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,UAAqC;QAErC,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,WAAW,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAwB;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAA8C,CAAC;QACvE,aAAa,CACX,MAAM,EACN,sDAAsD,QAAQ,CAAC,SAAS,EAAE,CAC3E,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK;aACX,MAAM,EAAE;aACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aACxD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAClB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;SACzD,CAAC,CACH,CACJ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAC9B,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,yEAAyE;QACzE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK;aACF,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC;aACtE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACtB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;SACtD,CAAC,CACH,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.d.ts

@@ -9,6 +9,7 @@ export declare class SimIamCloudFormationResourceFactory implements SimCfnServic
     private readonly managedPolicyCreator;
     private readonly policyCreator;
     private readonly roleCreator;
+    private readonly userCreator;
     private readonly deleter;
     constructor(iam: SimIam);
     /**

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAK5C,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wDAAwD,CAAC;AAErH;;GAEG;AACH,qBAAa,mCAAoC,YAAW,4BAA4B;IACtF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAgC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,GAAG,EAAE,MAAM,EAKtB;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2B7B;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAMf;CACF"}
+{"version":3,"file":"sim-cfn-iam-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAM5C,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wDAAwD,CAAC;AAErH;;GAEG;AACH,qBAAa,mCAAoC,YAAW,4BAA4B;IACtF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAgC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,GAAG,EAAE,MAAM,EAMtB;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiC7B;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAMf;CACF"}

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnIamManagedPolicyCreator } from "./managed-policy/sim-cfn-iam-managed-policy-creator.js";
 import { SimCfnIamPolicyCreator } from "./policy/sim-cfn-iam-policy-creator.js";
 import { SimCfnIamRoleCreator } from "./role/sim-cfn-iam-role-creator.js";
+import { SimCfnIamUserCreator } from "./user/sim-cfn-iam-user-creator.js";
 import { SimCfnIamResourceDeleter } from "./sim-cfn-iam-resource-deleter.js";
 /**
  * CloudFormation Resource factory for simulated IAM resources.
@@ -9,11 +10,13 @@ export class SimIamCloudFormationResourceFactory {
     managedPolicyCreator;
     policyCreator;
     roleCreator;
+    userCreator;
     deleter;
     constructor(iam) {
         this.managedPolicyCreator = new SimCfnIamManagedPolicyCreator({ iam });
         this.policyCreator = new SimCfnIamPolicyCreator({ iam });
         this.roleCreator = new SimCfnIamRoleCreator({ iam });
+        this.userCreator = new SimCfnIamUserCreator({ iam });
         this.deleter = new SimCfnIamResourceDeleter({ iam });
     }
     /**
@@ -31,6 +34,9 @@ export class SimIamCloudFormationResourceFactory {
             case "Role": {
                 return await this.roleCreator.create(resource, context.resolvedProperties ?? resource.properties);
             }
+            case "User": {
+                return await this.userCreator.create(resource, context.resolvedProperties ?? resource.properties);
+            }
             default: {
                 throw new Error(`Unsupported sim IAM CloudFormation Resource ${resourceTypeName}`);
             }

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E;;GAEG;AACH,MAAM,OAAO,mCAAmC;IAC7B,oBAAoB,CAAgC;IACpD,aAAa,CAAyB;IACtC,WAAW,CAAuB;IAClC,OAAO,CAA2B;IAEnD,YAAY,GAAW;QACrB,IAAI,CAAC,oBAAoB,GAAG,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,aAAa,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,eAAe,EAAE,CAAC;gBACrB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAC3C,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAC7B,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAClC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CACvB,gBAAgB,EAChB,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/iam/cfn/sim-cfn-iam-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E;;GAEG;AACH,MAAM,OAAO,mCAAmC;IAC7B,oBAAoB,CAAgC;IACpD,aAAa,CAAyB;IACtC,WAAW,CAAuB;IAClC,WAAW,CAAuB;IAClC,OAAO,CAA2B;IAEnD,YAAY,GAAW;QACrB,IAAI,CAAC,oBAAoB,GAAG,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,aAAa,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,eAAe,EAAE,CAAC;gBACrB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAC3C,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAC7B,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAClC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAClC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CACvB,gBAAgB,EAChB,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.d.ts

@@ -0,0 +1,28 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamUser } from "../../user/sim-iam-user.js";
+interface SimCfnIamUserCreatorProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Creates simulated IAM Users from CloudFormation Resources.
+ */
+export declare class SimCfnIamUserCreator {
+    private readonly iam;
+    private readonly propsParser;
+    constructor(properties: SimCfnIamUserCreatorProperties);
+    /**
+     * Create a simulated User from an AWS::IAM::User Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamUser>;
+    private putInlinePolicies;
+    private attachManagedPolicies;
+    /**
+     * Give the User a console password, the way real CloudFormation calls
+     * CreateLoginProfile for a `LoginProfile` property.
+     */
+    private createLoginProfile;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-user-creator.d.ts.map

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-user-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/user/sim-cfn-iam-user-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,4BAA4B,CAAC;AAO7E,UAAU,8BAA8B;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,YAAY,UAAU,EAAE,8BAA8B,EAErD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,UAAU,CAAC,CAuBrB;YAEa,iBAAiB;YAgBjB,qBAAqB;IAenC;;;OAGG;YACW,kBAAkB;CAiBjC"}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.js

@@ -0,0 +1,67 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnIamUserPropertiesParser, } from "./sim-cfn-iam-user-properties-parser.js";
+/**
+ * Creates simulated IAM Users from CloudFormation Resources.
+ */
+export class SimCfnIamUserCreator {
+    iam;
+    propsParser = new SimCfnIamUserPropertiesParser();
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Create a simulated User from an AWS::IAM::User Resource.
+     */
+    async create(resource, properties) {
+        const userProperties = this.propsParser.parse(resource, properties);
+        await this.iam.createUser({
+            input: {
+                UserName: userProperties.userName,
+                Path: userProperties.path,
+            },
+        });
+        await Promise.all([
+            this.putInlinePolicies(userProperties),
+            this.attachManagedPolicies(userProperties),
+            this.createLoginProfile(userProperties),
+        ]);
+        const user = this.iam.users.get(userProperties.userName);
+        assertDefined(user, `Sim IAM User ${userProperties.userName} after CloudFormation creation`);
+        return user;
+    }
+    async putInlinePolicies(userProperties) {
+        await Promise.all(userProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putUserPolicy({
+            input: {
+                UserName: userProperties.userName,
+                PolicyName: inlinePolicy.policyName,
+                PolicyDocument: inlinePolicy.policyDocument,
+            },
+        })));
+    }
+    async attachManagedPolicies(userProperties) {
+        await Promise.all(userProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachUserPolicy({
+            input: {
+                UserName: userProperties.userName,
+                PolicyArn: policyArn,
+            },
+        })));
+    }
+    /**
+     * Give the User a console password, the way real CloudFormation calls
+     * CreateLoginProfile for a `LoginProfile` property.
+     */
+    async createLoginProfile(userProperties) {
+        const { loginProfile } = userProperties;
+        if (loginProfile === undefined) {
+            return;
+        }
+        await this.iam.createLoginProfile({
+            input: {
+                UserName: userProperties.userName,
+                Password: loginProfile.password,
+                PasswordResetRequired: loginProfile.passwordResetRequired,
+            },
+        });
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-user-creator.js.map

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-user-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/user/sim-cfn-iam-user-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,6BAA6B,GAE9B,MAAM,yCAAyC,CAAC;AAMjD;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,GAAG,CAAS;IACZ,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEnE,YAAY,UAA0C;QACpD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,IAAI,EAAE,cAAc,CAAC,IAAI;aAC1B;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC;YAC1C,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAA0B,CAAC,CAAC;QAC3E,aAAa,CACX,IAAI,EACJ,gBAAgB,cAAc,CAAC,QAAQ,gCAAgC,CACxE,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,cAAuC;QAEvC,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,cAAuC;QAEvC,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,kBAAkB,CAC9B,cAAuC;QAEvC,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC;QAExC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAChC,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;aAC1D;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimIam } from "../../sim-iam.js";
+interface SimCfnIamUserDeleterProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Deletes simulated Users created from AWS::IAM::User Resources.
+ *
+ * DeleteUser refuses a User that still has policies on it, the way DeleteRole
+ * refuses a Role, so the User's policies come off first. Real CloudFormation
+ * does the same for the ones it put there itself: a `ManagedPolicyArns` entry
+ * is detached and a `Policies` entry removed as part of deleting the User.
+ *
+ * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
+ * User record here rather than through a command.
+ */
+export declare class SimCfnIamUserDeleter {
+    private readonly iam;
+    constructor(properties: SimCfnIamUserDeleterProperties);
+    /**
+     * Delete the User a CloudFormation Resource created.
+     */
+    delete(resource: SimCfnResource): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-user-deleter.d.ts.map

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-user-deleter.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/user/sim-cfn-iam-user-deleter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAI/C,UAAU,8BAA8B;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,8BAA8B,EAErD;IAED;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpD;CACF"}