@kensio/yulin 1.17.0 → 1.17.2

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-function.js

@@ -18,24 +18,29 @@ export class SimEventBridgeDeliveryFunction {
      * Invoke the function with the event, if it admits EventBridge for this
      * rule.
      *
-     * The resource policy is consulted on every delivery rather than remembered
+     * The function, the version or alias a qualified target named, and the
+     * resource policy are all resolved on every delivery rather than remembered
      * from the moment the target was added, so a permission taken away
-     * afterwards stops delivery. Real EventBridge does not check it at
-     * `PutTargets` time either.
+     * afterwards stops delivery and an alias moved to another version moves what
+     * runs. Real EventBridge does not check any of it at `PutTargets` time
+     * either.
      */
     async deliver(request) {
         const source = simEventBridgeDeliverySource(request);
         const targetArn = request.target.arn;
-        const simFunction = this.scope
+        const target = this.scope
             .lambda()
-            .getSimFunctionByName(targetArn.functionName);
-        if (simFunction === undefined) {
-            throw new SimEventBridgeTargetNotFound(`${targetArn.value} is not a simulated Lambda function.`);
+            .getSimFunctionTarget(targetArn.functionName, targetArn.functionQualifier);
+        if (target === undefined) {
+            throw new SimEventBridgeTargetNotFound(targetArn.functionQualifier === undefined
+                ? `${targetArn.value} is not a simulated Lambda function.`
+                : `${targetArn.value} names no simulated Lambda function version ` +
+                    "or alias.");
         }
         const decision = new SimLambdaServiceInvokeAuthorizer({
             iam: this.scope.iam(),
         }).authorize({
-            simFunction,
+            resource: target.resource,
             servicePrincipal: simEventBridgeServicePrincipal,
             ...source,
         });
@@ -49,7 +54,7 @@ export class SimEventBridgeDeliveryFunction {
         // asynchronous invocation real EventBridge makes, and because a handler
         // failure has to reach the delivery outcome rather than being swallowed
         // as an asynchronous invocation error.
-        await simFunction.invoke(simEventBridgeDeliveryDocument(request));
+        await target.simFunction.invoke(simEventBridgeDeliveryDocument(request));
     }
 }
 //# sourceMappingURL=sim-event-bridge-delivery-function.js.map

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-function.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-bridge-delivery-function.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/delivery/sim-event-bridge-delivery-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EACL,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,8BAA8B,EAC9B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAMxC;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAA+B;IAErD,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAsC;QAClD,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK;aAC3B,MAAM,EAAE;aACR,oBAAoB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,GAAG,SAAS,CAAC,KAAK,sCAAsC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC,SAAS,CAAC;YACX,WAAW;YACX,gBAAgB,EAAE,8BAA8B;YAChD,GAAG,MAAM;SACV,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kCAAkC,CAC1C,0BAA0B,SAAS,CAAC,KAAK,kBAAkB;gBACzD,GAAG,8BAA8B,oBAAoB;gBACrD,GAAG,MAAM,CAAC,SAAS,gCAAgC,CACtD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,WAAW,CAAC,MAAM,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-event-bridge-delivery-function.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/delivery/sim-event-bridge-delivery-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EACL,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,8BAA8B,EAC9B,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAMxC;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAA+B;IAErD,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAAsC;QAClD,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK;aACtB,MAAM,EAAE;aACR,oBAAoB,CACnB,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,iBAAiB,CAC5B,CAAC;QAEJ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,4BAA4B,CACpC,SAAS,CAAC,iBAAiB,KAAK,SAAS;gBACvC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,sCAAsC;gBAC1D,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,8CAA8C;oBAC9D,WAAW,CAClB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC,SAAS,CAAC;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,8BAA8B;YAChD,GAAG,MAAM;SACV,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kCAAkC,CAC1C,0BAA0B,SAAS,CAAC,KAAK,kBAAkB;gBACzD,GAAG,8BAA8B,oBAAoB;gBACrD,GAAG,MAAM,CAAC,SAAS,gCAAgC,CACtD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/eventbridge/target/sim-event-target-arn.d.ts

@@ -48,14 +48,21 @@ export declare class SimEventTargetArn {
      * something else in Lambda.
      *
      * A function ARN's resource is `function:<name>`, and may carry a version or
-     * alias after a second colon, which this simulation does not model and so
-     * reads as part of nothing. The resource type is checked rather than
-     * assumed, because Lambda writes more than functions this way: a layer is
-     * `layer:<name>` and an event source mapping is
-     * `event-source-mapping:<uuid>`, and taking the part after the first colon
-     * would read either as a function that is not there.
+     * alias after a second colon, which `functionQualifier` reads. The resource
+     * type is checked rather than assumed, because Lambda writes more than
+     * functions this way: a layer is `layer:<name>` and an event source mapping
+     * is `event-source-mapping:<uuid>`, and taking the part after the first
+     * colon would read either as a function that is not there.
      */
     get functionName(): string;
+    /**
+     * The version or alias this ARN qualified the function with, or nothing when
+     * it named the function itself.
+     *
+     * A rule delivers to the version a qualified target names, so the qualifier
+     * is read rather than dropped.
+     */
+    get functionQualifier(): string | undefined;
     /**
      * The name of the ECS cluster this ARN names, or nothing when it names
      * something else in ECS.

package/dist/service/eventbridge/target/sim-event-target-arn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;GAEG;AACH,eAAO,MAAM,sBAAsB,YAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AA4B5E;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAMN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAmDtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAmBpC;;;;;;;;;;;OAWG;IACH,IAAI,YAAY,IAAI,MAAM,CAIzB;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW,IAAI,MAAM,CAQxB;CACF"}
+{"version":3,"file":"sim-event-target-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;GAEG;AACH,eAAO,MAAM,sBAAsB,YAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AA4B5E;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAMN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAmDtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAmBpC;;;;;;;;;;OAUG;IACH,IAAI,YAAY,IAAI,MAAM,CAIzB;IAED;;;;;;OAMG;IACH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAI1C;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW,IAAI,MAAM,CAQxB;CACF"}

package/dist/service/eventbridge/target/sim-event-target-arn.js

@@ -116,17 +116,27 @@ export class SimEventTargetArn {
      * something else in Lambda.
      *
      * A function ARN's resource is `function:<name>`, and may carry a version or
-     * alias after a second colon, which this simulation does not model and so
-     * reads as part of nothing. The resource type is checked rather than
-     * assumed, because Lambda writes more than functions this way: a layer is
-     * `layer:<name>` and an event source mapping is
-     * `event-source-mapping:<uuid>`, and taking the part after the first colon
-     * would read either as a function that is not there.
+     * alias after a second colon, which `functionQualifier` reads. The resource
+     * type is checked rather than assumed, because Lambda writes more than
+     * functions this way: a layer is `layer:<name>` and an event source mapping
+     * is `event-source-mapping:<uuid>`, and taking the part after the first
+     * colon would read either as a function that is not there.
      */
     get functionName() {
-        const [resourceType, name = ""] = this.resource.split(":", 2);
+        const [resourceType, name = ""] = this.resource.split(":", 3);
         return resourceType === "function" ? name : "";
     }
+    /**
+     * The version or alias this ARN qualified the function with, or nothing when
+     * it named the function itself.
+     *
+     * A rule delivers to the version a qualified target names, so the qualifier
+     * is read rather than dropped.
+     */
+    get functionQualifier() {
+        const [resourceType, , qualifier] = this.resource.split(":", 3);
+        return resourceType === "function" ? qualifier : undefined;
+    }
     /**
      * The name of the ECS cluster this ARN names, or nothing when it names
      * something else in ECS.

package/dist/service/eventbridge/target/sim-event-target-arn.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target-arn.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAI/E;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;GAGG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACZ,KAAK,CAAS;IACd,OAAO,CAAwB;IAC/B,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAE3C;;OAEG;IACa,QAAQ,CAAS;IAEjC,YAAoB,UAAuC;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAyB;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAiC,CACzC,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,IACE,MAAM,KAAK,KAAK;YAChB,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,SAAS;YACrB,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,EAAE;YAChB,QAAQ,KAAK,EAAE;YACf,KAAK,CAAC,MAAM,GAAG,eAAe,EAC9B,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,KAAK,gBAAgB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,UAAU,KAAK,UAAU,OAAO,oCAAoC;gBAClE,cAAc,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAClE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;YACnB,KAAK;YACL,OAAO;YACP,UAAU,EAAE,UAA2B;YACvC,SAAS,EAAE,SAA4B;YACvC,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAEhC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACzD,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,8BAA8B;gBAC9B,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,6CAA6C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,YAAY;QACd,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW;QACb,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-event-target-arn.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAI/E;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;GAGG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACZ,KAAK,CAAS;IACd,OAAO,CAAwB;IAC/B,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAE3C;;OAEG;IACa,QAAQ,CAAS;IAEjC,YAAoB,UAAuC;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,KAAyB;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAiC,CACzC,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,IACE,MAAM,KAAK,KAAK;YAChB,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,SAAS;YACrB,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,EAAE;YAChB,QAAQ,KAAK,EAAE;YACf,KAAK,CAAC,MAAM,GAAG,eAAe,EAC9B,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,KAAK,gBAAgB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,UAAU,KAAK,UAAU,OAAO,oCAAoC;gBAClE,cAAc,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAClE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;YACnB,KAAK;YACL,OAAO;YACP,UAAU,EAAE,UAA2B;YACvC,SAAS,EAAE,SAA4B;YACvC,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAEhC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,qBAAqB,CAAC,GAAsB;QACzD,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,8BAA8B;gBAC9B,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,GAAG,CAAC,KAAK,YAAY;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,6CAA6C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,YAAY;QACd,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,IAAI,iBAAiB;QACnB,MAAM,CAAC,YAAY,EAAE,AAAD,EAAG,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEhE,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,WAAW;QACb,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts

@@ -0,0 +1,40 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamRoleName } from "../../role/sim-iam-role.js";
+interface SimCfnIamManagedPolicyAttacherProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export declare class SimCfnIamManagedPolicyAttacher {
+    private readonly iam;
+    constructor(properties: SimCfnIamManagedPolicyAttacherProperties);
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly SimIamRoleName[];
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[]): Promise<void>;
+    private roleName;
+    private rejectUnsimulatedPrincipals;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.d.ts.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,cAAc,EAAE,CAgB3B;IAED;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAQf;IAED,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,2BAA2B;CAcpC"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js

@@ -0,0 +1,65 @@
+import { SimIamNoSuchEntity } from "../../error/sim-iam.error.js";
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export class SimCfnIamManagedPolicyAttacher {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource, properties) {
+        this.rejectUnsimulatedPrincipals(resource, properties);
+        const roles = properties["Roles"];
+        if (roles === undefined) {
+            return [];
+        }
+        if (!Array.isArray(roles)) {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles must be an array`);
+        }
+        return roles.map((roleName) => this.roleName(resource, roleName));
+    }
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    async attach(policyArn, roleNames) {
+        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({
+            input: { RoleName: roleName, PolicyArn: policyArn },
+        })));
+    }
+    roleName(resource, roleName) {
+        if (typeof roleName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles entries must be strings`);
+        }
+        const simRoleName = roleName;
+        if (!this.iam.roles.has(simRoleName)) {
+            throw new SimIamNoSuchEntity(`No IAM Role with name ${roleName}`);
+        }
+        return simRoleName;
+    }
+    rejectUnsimulatedPrincipals(resource, properties) {
+        for (const principalProperty of ["Users", "Groups"]) {
+            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
+            if (properties[principalProperty] !== undefined) {
+                throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ` +
+                    `${principalProperty} are not simulated`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.js.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAMlE;;;;;;;;;GASG;AACH,MAAM,OAAO,8BAA8B;IACxB,GAAG,CAAS;IAE7B,YAAY,UAAoD;QAC9D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,0BAA0B,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,SAAiB,EACjB,SAAoC;QAEpC,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;SACpD,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,QAAwB,EACxB,QAAiB;QAEjB,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,iCAAiC,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,QAA0B,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,IAAI;oBACvD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -10,6 +10,7 @@ interface SimCfnIamManagedPolicyCreatorProperties {
  */
 export declare class SimCfnIamManagedPolicyCreator {
     private readonly iam;
+    private readonly attacher;
     constructor(properties: SimCfnIamManagedPolicyCreatorProperties);
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAI1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAE1D,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -1,16 +1,20 @@
+import { SimCfnIamManagedPolicyAttacher } from "./sim-cfn-iam-managed-policy-attacher.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Creates simulated IAM Managed Policies from CloudFormation Resources.
  */
 export class SimCfnIamManagedPolicyCreator {
     iam;
+    attacher;
     constructor(properties) {
         this.iam = properties.iam;
+        this.attacher = new SimCfnIamManagedPolicyAttacher({ iam: properties.iam });
     }
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
     async create(resource, properties) {
+        const roleNames = this.attacher.roleNames(resource, properties);
         const policyName = this.managedPolicyName(resource, properties);
         const path = this.path(resource, properties);
         const description = this.description(resource, properties);
@@ -25,6 +29,7 @@ export class SimCfnIamManagedPolicyCreator {
         });
         const policy = this.iam.policies.get(policyCreation.Policy.Arn);
         assertDefined(policy, `Sim IAM Managed Policy ${policyCreation.Policy.Arn} after CloudFormation creation`);
+        await this.attacher.attach(policy.arn, roleNames);
         return policy;
     }
     managedPolicyName(resource, properties) {

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IAE7B,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IACZ,QAAQ,CAAiC;IAE1D,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -5,35 +5,26 @@ interface SimCfnIamPolicyCreatorProperties {
     readonly iam: SimIam;
 }
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export declare class SimCfnIamPolicyCreator {
     private readonly iam;
+    private readonly propsParser;
     constructor(properties: SimCfnIamPolicyCreatorProperties);
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
-    private policyName;
-    private policyDocument;
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    private roleNames;
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    private rejectUnsimulatedPrincipals;
+    private putRolePolicies;
+    private putUserPolicies;
 }
 export {};
 //# sourceMappingURL=sim-cfn-iam-policy-creator.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,cAAc;IAoBtB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAsBjB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;CAcpC"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IAErE,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CASpB;YAEa,eAAe;YAgBf,eAAe;CAe9B"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -1,81 +1,49 @@
+import { SimCfnIamPolicyPropertiesParser, } from "./sim-cfn-iam-policy-properties-parser.js";
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export class SimCfnIamPolicyCreator {
     iam;
+    propsParser = new SimCfnIamPolicyPropertiesParser();
     constructor(properties) {
         this.iam = properties.iam;
     }
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     async create(resource, properties) {
-        this.rejectUnsimulatedPrincipals(resource, properties);
-        const policyName = this.policyName(resource, properties);
-        const policyDocument = this.policyDocument(resource, properties);
-        const roleNames = this.roleNames(resource, properties);
-        await Promise.all(roleNames.map(async (roleName) => this.iam.putRolePolicy({
+        const policyProperties = this.propsParser.parse(resource, properties);
+        await Promise.all([
+            this.putRolePolicies(policyProperties),
+            this.putUserPolicies(policyProperties),
+        ]);
+        return undefined;
+    }
+    async putRolePolicies(policyProperties) {
+        await Promise.all(policyProperties.roleNames.map(async (roleName) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleName,
-                PolicyName: policyName,
-                PolicyDocument: policyDocument,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
             },
         })));
-        return undefined;
-    }
-    policyName(resource, properties) {
-        const policyName = properties["PolicyName"];
-        if (typeof policyName !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyName must be a string`);
-        }
-        return policyName;
     }
-    policyDocument(resource, properties) {
-        const policyDocument = properties["PolicyDocument"];
-        if (policyDocument === undefined ||
-            typeof policyDocument !== "object" ||
-            policyDocument === null ||
-            Array.isArray(policyDocument)) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyDocument must be an object`);
-        }
-        return JSON.stringify(policyDocument);
-    }
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    roleNames(resource, properties) {
-        const roles = properties["Roles"];
-        if (!Array.isArray(roles) || roles.length === 0) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles must be a non-empty array`);
-        }
-        return roles.map((roleName) => {
-            if (typeof roleName !== "string") {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles entries must be strings`);
-            }
-            return roleName;
-        });
-    }
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    rejectUnsimulatedPrincipals(resource, properties) {
-        for (const principalProperty of ["Users", "Groups"]) {
-            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
-            if (properties[principalProperty] !== undefined) {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: ` +
-                    `${principalProperty} are not simulated`);
-            }
-        }
+    async putUserPolicies(policyProperties) {
+        await Promise.all(policyProperties.usernames.map(async (username) => this.iam.putUserPolicy({
+            input: {
+                UserName: username,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
+            },
+        })));
     }
 }
 //# sourceMappingURL=sim-cfn-iam-policy-creator.js.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IAE7B,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,UAAU;gBACtB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CACH,CACF,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,+BAA+B,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,oCAAoC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,mCAAmC,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,iCAAiC,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,IAAI;oBAChD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AAMnD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IACZ,WAAW,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAErE,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;SACvC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts

@@ -0,0 +1,38 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+export interface SimCfnIamPolicyProperties {
+    readonly policyName: string;
+    readonly policyDocument: string;
+    readonly roleNames: readonly string[];
+    readonly usernames: readonly string[];
+}
+/**
+ * Parses and validates AWS::IAM::Policy CloudFormation properties into the
+ * shape the sim IAM inline policy creator needs.
+ *
+ * Keeping the property-shape validation here keeps the creator focused on
+ * orchestrating IAM command calls.
+ */
+export declare class SimCfnIamPolicyPropertiesParser {
+    /**
+     * Parse the resolved CloudFormation properties for an AWS::IAM::Policy.
+     */
+    parse(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnIamPolicyProperties;
+    private policyName;
+    private policyDocument;
+    /**
+     * The principal names one property attaches the policy to. Role and User
+     * Refs are resolved to names before creation, so entries arrive as plain
+     * strings. An absent property is not an error on its own, because a policy
+     * naming only the other kind of principal is the usual CDK shape.
+     */
+    private principalNames;
+    /**
+     * IAM Groups are not simulated as CloudFormation policy principals, and
+     * silently dropping a grant would be misleading, so their presence fails
+     * creation.
+     */
+    private rejectGroups;
+    private invalid;
+}
+//# sourceMappingURL=sim-cfn-iam-policy-properties-parser.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAMD;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,yBAAyB,CAmB3B;IAED,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAiBtB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,OAAO;CAKhB"}