@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/acm/command/delete-certificate/delete-certificate-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteCertificateAuthorizer.action,
                 resource: certificateArn,
             });

package/dist/service/acm/command/describe-certificate/describe-certificate-authorizer.js

@@ -32,6 +32,7 @@ export class DescribeCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DescribeCertificateAuthorizer.action,
                 resource: certificateArn,
             });

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.js

@@ -32,6 +32,7 @@ export class ListCertificatesAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListCertificatesAuthorizer.action,
                 resource: ListCertificatesAuthorizer.resource,
             });

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.js

@@ -29,6 +29,7 @@ export class RequestCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: RequestCertificateAuthorizer.action,
                 resource: this.resource,
             });

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js

@@ -49,6 +49,9 @@ export class SimRestApiAuthorizerPolicy {
                 },
             ],
             resourcePolicies: [],
+            // An authorizer's policy document is evaluated on its own. No Account
+            // boundary is being crossed here, so no service control policy applies.
+            serviceControlPolicies: { applies: false, levels: [] },
             allowRequirement: new SimIamEitherSideAllowRequirement(),
             action: simExecuteApiInvokeAction,
             resource: methodArn,

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js

@@ -39,6 +39,9 @@ export class SimHttpApiAuthorizerPolicy {
                 },
             ],
             resourcePolicies: [],
+            // An authorizer's policy document is evaluated on its own. No Account
+            // boundary is being crossed here, so no service control policy applies.
+            serviceControlPolicies: { applies: false, levels: [] },
             allowRequirement: new SimIamEitherSideAllowRequirement(),
             action: simExecuteApiInvokeAction,
             resource: routeArn,

package/dist/service/athena/engine/sim-athena-regexp-flags.d.ts

@@ -0,0 +1,22 @@
+/** One pattern and the flags to compile it with. */
+export interface SimAthenaLiftedPattern {
+    readonly pattern: string;
+    readonly flags: string;
+}
+/**
+ * One pattern with the flags Java writes inside it lifted out beside it.
+ *
+ * Athena's regular expressions are Joni, which reads `(?i)` at the head of a
+ * pattern as a flag over the whole of it. JavaScript reads the same text as a
+ * group and refuses it. `(?i)`, `(?m)` and `(?s)` map onto flags of the same
+ * letter, and lifting them is all it takes.
+ *
+ * A flag Joni has and JavaScript has not, `(?x)` among them, stays in the
+ * pattern for `RegExp` to turn down. So does a group written anywhere but the
+ * head, since JavaScript has no way to turn a flag on part way through. The
+ * scoped form `(?i:...)` needs nothing done to it and already runs.
+ *
+ * A flag group captures nothing in Java, so taking one off the front leaves
+ * the capture groups numbered as the statement wrote them.
+ */
+export declare function simAthenaLiftedPattern(pattern: string, flags: string): SimAthenaLiftedPattern;

package/dist/service/athena/engine/sim-athena-regexp-flags.js

@@ -0,0 +1,34 @@
+/** One of Java's inline flag groups at the head of a pattern, as `(?i)`. */
+const leadingFlag = /^\(\?[ims]+\)/u;
+/**
+ * One pattern with the flags Java writes inside it lifted out beside it.
+ *
+ * Athena's regular expressions are Joni, which reads `(?i)` at the head of a
+ * pattern as a flag over the whole of it. JavaScript reads the same text as a
+ * group and refuses it. `(?i)`, `(?m)` and `(?s)` map onto flags of the same
+ * letter, and lifting them is all it takes.
+ *
+ * A flag Joni has and JavaScript has not, `(?x)` among them, stays in the
+ * pattern for `RegExp` to turn down. So does a group written anywhere but the
+ * head, since JavaScript has no way to turn a flag on part way through. The
+ * scoped form `(?i:...)` needs nothing done to it and already runs.
+ *
+ * A flag group captures nothing in Java, so taking one off the front leaves
+ * the capture groups numbered as the statement wrote them.
+ */
+export function simAthenaLiftedPattern(pattern, flags) {
+    const letters = new Set();
+    let rest = pattern;
+    let head = leadingFlag.exec(rest);
+    while (head !== null) {
+        // Everything the group holds between its `(?` and its `)`.
+        const written = head[0].slice(2, -1);
+        for (const letter of written) {
+            letters.add(letter);
+        }
+        rest = rest.slice(head[0].length);
+        head = leadingFlag.exec(rest);
+    }
+    const added = [...letters].filter((letter) => !flags.includes(letter));
+    return { pattern: rest, flags: flags + added.join("") };
+}

package/dist/service/athena/engine/sim-athena-regexp-shims.js

@@ -1,4 +1,5 @@
 import { SimAthenaSetUpError } from "../error/sim-athena.error.js";
+import { simAthenaLiftedPattern } from "./sim-athena-regexp-flags.js";
 import { isExplicitNull, shimNumber, shimText, simAthenaScalarShim, } from "./sim-athena-shim-registry.js";
 /**
  * Trino's regular expression functions.
@@ -79,10 +80,11 @@ function expressionFor(pattern, flags = "u") {
     if (pattern === undefined) {
         return undefined;
     }
+    const lifted = simAthenaLiftedPattern(pattern, flags);
     try {
         // The pattern is the query's own, which is the whole point of the function.
         // oxlint-disable-next-line security/detect-non-literal-regexp
-        return new RegExp(pattern, flags);
+        return new RegExp(lifted.pattern, lifted.flags);
     }
     catch {
         return undefined;

package/dist/service/athena/engine/sim-athena-url-parts.d.ts

@@ -0,0 +1,24 @@
+/** One URI reference split the way Java's `URI` splits it. */
+export interface SimAthenaUrlParts {
+    readonly protocol: string;
+    readonly host: string;
+    readonly port: number | null;
+    readonly path: string;
+    readonly query: string;
+    readonly fragment: string;
+}
+/**
+ * One URI reference split into its parts, or nothing where it is no reference.
+ *
+ * Trino reads a URL with `new URI(text)`, which takes a reference with no
+ * scheme of its own. `/reports/august?tenant=acme` is one, and it is the shape
+ * a CloudFront access log holds, since the log carries the path and the query
+ * in columns of their own and no whole URL anywhere.
+ *
+ * The parts are read off the text rather than resolved against a base. That is
+ * what `URI` does, and it keeps a relative path as the text wrote it.
+ *
+ * A part the reference leaves out comes back as the empty string, which is
+ * what Trino answers for one. The port has no empty form and answers null.
+ */
+export declare function simAthenaUrlParts(text: string): SimAthenaUrlParts | undefined;

package/dist/service/athena/engine/sim-athena-url-parts.js

@@ -0,0 +1,76 @@
+/**
+ * A URI reference, split as RFC 3986 writes the expression for it.
+ *
+ * This is the expression the RFC prints in its own appendix, character for
+ * character. Its groups are optional and never nested, so what a reference
+ * that does not match costs in backtracking is bounded by the text's length.
+ */
+const reference = 
+// oxlint-disable-next-line security/detect-unsafe-regex
+/^(?:([^:/?#]+):)?(?:\/\/([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?$/u;
+/** The characters RFC 2396 allows, which is what Java's `URI` takes. */
+const disallowed = /[^A-Za-z0-9;/?:@&=+$,\-_.!~*'()%[\]#]/u;
+/** A percent naming no byte, which Java's `URI` reads as malformed. */
+const malformedEscape = /%(?![0-9A-Fa-f]{2})/u;
+/** A scheme starts with a letter and carries no other punctuation. */
+const schemeName = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+const digits = /^\d+$/u;
+/**
+ * One URI reference split into its parts, or nothing where it is no reference.
+ *
+ * Trino reads a URL with `new URI(text)`, which takes a reference with no
+ * scheme of its own. `/reports/august?tenant=acme` is one, and it is the shape
+ * a CloudFront access log holds, since the log carries the path and the query
+ * in columns of their own and no whole URL anywhere.
+ *
+ * The parts are read off the text rather than resolved against a base. That is
+ * what `URI` does, and it keeps a relative path as the text wrote it.
+ *
+ * A part the reference leaves out comes back as the empty string, which is
+ * what Trino answers for one. The port has no empty form and answers null.
+ */
+export function simAthenaUrlParts(text) {
+    if (disallowed.test(text) || malformedEscape.test(text)) {
+        return undefined;
+    }
+    const found = reference.exec(text);
+    if (found === null) {
+        return undefined;
+    }
+    const scheme = found.at(1);
+    if (scheme !== undefined && !schemeName.test(scheme)) {
+        return undefined;
+    }
+    const authority = found.at(2);
+    const path = found.at(3) ?? "";
+    // A scheme followed by anything but a slash is an opaque URI, and Java reads
+    // neither a path nor a query out of one. `mailto:a@b` is the case.
+    const opaque = scheme !== undefined && authority === undefined && !path.startsWith("/");
+    return {
+        protocol: scheme ?? "",
+        ...hostAndPort(authority),
+        path: opaque ? "" : path,
+        query: opaque ? "" : (found.at(4) ?? ""),
+        fragment: found.at(5) ?? "",
+    };
+}
+/**
+ * The host and the port one authority names.
+ *
+ * The user's own credentials sit before an `@` and are no part of the host, so
+ * the digits in `user:1234@rain.example` are no port. A colon with anything
+ * but digits after it belongs to the host, which is what keeps the one inside
+ * an IPv6 literal out of the port.
+ */
+function hostAndPort(authority) {
+    if (authority === undefined) {
+        return { host: "", port: null };
+    }
+    const written = authority.slice(authority.lastIndexOf("@") + 1);
+    const colon = written.lastIndexOf(":");
+    const port = written.slice(colon + 1);
+    if (colon === -1 || !digits.test(port)) {
+        return { host: written, port: null };
+    }
+    return { host: written.slice(0, colon), port: Number(port) };
+}

package/dist/service/athena/engine/sim-athena-url-shims.d.ts

@@ -2,8 +2,9 @@ import type { DatabaseSync } from "node:sqlite";
 /**
  * Trino's URL functions, which a query over access logs reaches for.
  *
- * Trino fails a query over text that is no URL and these answer null, the same
- * forgiving direction the rest of the engine takes.
+ * The extract functions answer null over text that is no URI reference, and so
+ * does Trino. Each one is `neverFails` there and answers null off a `URI` that
+ * would not parse.
  *
  * Trino answers with an empty string for a part the URL leaves out, apart from
  * the port, which has no empty form and answers null.

package/dist/service/athena/engine/sim-athena-url-shims.js

@@ -1,17 +1,20 @@
 import { shimText, simAthenaScalarShim } from "./sim-athena-shim-registry.js";
-/** What each `url_extract` function reads off a parsed URL. */
+import { simAthenaUrlParts, } from "./sim-athena-url-parts.js";
+/** What each `url_extract` function reads off a split reference. */
 const parts = new Map([
-    ["url_extract_host", (url) => url.hostname],
-    ["url_extract_path", (url) => url.pathname],
-    ["url_extract_protocol", (url) => url.protocol.replace(":", "")],
-    ["url_extract_fragment", (url) => url.hash.replace("#", "")],
-    ["url_extract_query", (url) => url.search.replace("?", "")],
+    ["url_extract_host", (url) => url.host],
+    ["url_extract_path", (url) => url.path],
+    ["url_extract_protocol", (url) => url.protocol],
+    ["url_extract_fragment", (url) => url.fragment],
+    ["url_extract_query", (url) => url.query],
+    ["url_extract_port", (url) => url.port],
 ]);
 /**
  * Trino's URL functions, which a query over access logs reaches for.
  *
- * Trino fails a query over text that is no URL and these answer null, the same
- * forgiving direction the rest of the engine takes.
+ * The extract functions answer null over text that is no URI reference, and so
+ * does Trino. Each one is `neverFails` there and answers null off a `URI` that
+ * would not parse.
  *
  * Trino answers with an empty string for a part the URL leaves out, apart from
  * the port, which has no empty form and answers null.
@@ -19,39 +22,68 @@ const parts = new Map([
 export function simAthenaInstallUrlShims(database) {
     for (const [name, read] of parts) {
         simAthenaScalarShim(database, name, (value) => {
-            const url = parsedUrl(shimText(value));
+            const url = readParts(shimText(value));
             return url === undefined ? null : read(url);
         });
     }
-    simAthenaScalarShim(database, "url_extract_port", (value) => writtenPort(shimText(value)));
     simAthenaScalarShim(database, "url_extract_parameter", (value, name) => {
         const wanted = shimText(name);
-        const url = parsedUrl(shimText(value));
+        const url = readParts(shimText(value));
         if (url === undefined || wanted === undefined) {
             return null;
         }
-        return url.searchParams.get(wanted);
+        return new URLSearchParams(url.query).get(wanted);
     });
+    simAthenaScalarShim(database, "url_decode", (value) => decoded(shimText(value)));
+    simAthenaScalarShim(database, "url_encode", (value) => encoded(shimText(value)));
 }
-/** Everything between the scheme and the path, which is where a port is written. */
-const authority = /^[A-Za-z][\w+.-]*:\/\/[^/?#]*/u;
 /**
- * The port one URL names, or nothing where it names none.
+ * One value with its escapes read back, the way `url_decode` reads them.
  *
- * Read off the text rather than off the parsed URL, because the parser drops a
- * port that is the scheme's own default. Trino answers with the port a URL was
- * written with, so `http://rain.example:80/a` is eighty rather than nothing.
+ * Trino runs `URLDecoder.decode` over UTF-8, which reads `+` as a space and
+ * `%2B` as a plus. Replacing the plus before decoding is what keeps the two
+ * apart.
+ *
+ * Trino raises over an escape that names no byte, and writes a replacement
+ * character where the bytes it names are no UTF-8. `decodeURIComponent` throws
+ * over both, and this answers null for both, the same forgiving direction the
+ * rest of the file takes.
  */
-function writtenPort(value) {
-    if (value === undefined || parsedUrl(value) === undefined) {
+function decoded(value) {
+    if (value === undefined) {
+        return null;
+    }
+    try {
+        return decodeURIComponent(value.replaceAll("+", " "));
+    }
+    catch {
         return null;
     }
-    const written = /:(\d+)$/u.exec(authority.exec(value)?.[0] ?? "")?.[1];
-    return written === undefined ? null : Number(written);
 }
-function parsedUrl(value) {
+/**
+ * One value escaped for a query string, the way `url_encode` escapes it.
+ *
+ * Trino runs Guava's form-parameter escaper, which keeps `-`, `_`, `.` and `*`
+ * alone and writes a space as `+`. `encodeURIComponent` keeps five characters
+ * beyond those four, and each of those is escaped here.
+ *
+ * No escape written here carries a character a later pass looks for, and a
+ * space is the only character `encodeURIComponent` writes as `%20`, since a
+ * percent in the value has already become `%25` by then.
+ */
+function encoded(value) {
     if (value === undefined) {
-        return undefined;
+        return null;
     }
-    return URL.parse(value) ?? undefined;
+    return encodeURIComponent(value)
+        .replaceAll("!", "%21")
+        .replaceAll("'", "%27")
+        .replaceAll("(", "%28")
+        .replaceAll(")", "%29")
+        .replaceAll("~", "%7E")
+        .replaceAll("%20", "+");
+}
+/** One value split into its URL parts, or nothing where it is null or no URL. */
+function readParts(value) {
+    return value === undefined ? undefined : simAthenaUrlParts(value);
 }

package/dist/service/athena/table/sim-athena-negated-columns.d.ts

@@ -0,0 +1,17 @@
+import type { SimAthenaSqlToken } from "./sim-athena-sql-tokens.js";
+/**
+ * The columns a `NOT` in this query could have negated.
+ *
+ * A negated value names the partition a query does not want, so a column under
+ * a `NOT` is left unconstrained. A query filtering bots out of a day's logs
+ * negates nothing about the day, and reading how far each `NOT` reaches is
+ * what tells the two apart.
+ *
+ * An infix `NOT`, as in `day NOT IN ('a')`, is read as reaching nothing. Its
+ * own column keeps whatever else the statement constrains it to, and that is
+ * always a superset of what Athena reads, since `day = 'a' AND day NOT IN (x)`
+ * can only ever narrow. The query applies the exclusion itself once the rows
+ * are in. Naming the column here would drop its filter and widen the scan to
+ * every partition.
+ */
+export declare function simAthenaNegatedColumns(tokens: readonly SimAthenaSqlToken[]): ReadonlySet<string>;

package/dist/service/athena/table/sim-athena-negated-columns.js

@@ -0,0 +1,80 @@
+/**
+ * The columns a `NOT` in this query could have negated.
+ *
+ * A negated value names the partition a query does not want, so a column under
+ * a `NOT` is left unconstrained. A query filtering bots out of a day's logs
+ * negates nothing about the day, and reading how far each `NOT` reaches is
+ * what tells the two apart.
+ *
+ * An infix `NOT`, as in `day NOT IN ('a')`, is read as reaching nothing. Its
+ * own column keeps whatever else the statement constrains it to, and that is
+ * always a superset of what Athena reads, since `day = 'a' AND day NOT IN (x)`
+ * can only ever narrow. The query applies the exclusion itself once the rows
+ * are in. Naming the column here would drop its filter and widen the scan to
+ * every partition.
+ */
+export function simAthenaNegatedColumns(tokens) {
+    const negated = new Set();
+    for (const [position, token] of tokens.entries()) {
+        if (token.kind === "word" && token.text === "not") {
+            for (const name of namesUnder(tokens, position)) {
+                negated.add(name.toLowerCase());
+            }
+        }
+    }
+    return negated;
+}
+/** The words a `NOT` reaches no further than, `OR` aside. */
+const boundary = new Set([
+    "and",
+    "except",
+    "from",
+    "group",
+    "having",
+    "intersect",
+    "limit",
+    "offset",
+    "order",
+    "union",
+    "where",
+    "window",
+]);
+/**
+ * The identifiers one `NOT` reaches.
+ *
+ * `NOT` binds tighter than `AND`, so its reach ends at the next of the words
+ * above, outside any brackets, and at the bracket the `NOT` itself sits in.
+ * `OR` is absent from that list because a query carrying one is left
+ * unfiltered before this runs.
+ *
+ * Nothing here parses, so a name a `NOT` could not really have reached is
+ * dropped anyway. That direction only ever leaves a column unfiltered, which
+ * is the answer a query with no filter gets.
+ */
+function namesUnder(tokens, position) {
+    const names = [];
+    let depth = 0;
+    let cursor = position + 1;
+    while (cursor < tokens.length) {
+        const token = tokens.at(cursor);
+        if (token?.kind === "symbol" && token.text === "(") {
+            depth += 1;
+        }
+        else if (token?.kind === "symbol" && token.text === ")") {
+            if (depth === 0) {
+                return names;
+            }
+            depth -= 1;
+        }
+        else if (depth === 0 &&
+            token?.kind === "word" &&
+            boundary.has(token.text)) {
+            return names;
+        }
+        else if (token?.kind === "word" || token?.kind === "quoted") {
+            names.push(token.text);
+        }
+        cursor += 1;
+    }
+    return names;
+}

package/dist/service/athena/table/sim-athena-partition-filters.d.ts

@@ -2,10 +2,13 @@
  * The partition values a query's `WHERE` clause pins down.
  *
  * Only two shapes are read, `column = 'value'` and `column IN ('a', 'b')`, and
- * they are read wherever they appear. A query carrying `OR` or `NOT` anywhere
- * is left unfiltered. A value under one arm of an `OR` constrains nothing on
- * its own, and a negated one names the partition the query does not want, so
- * reading either as a constraint would answer from the wrong prefixes.
+ * they are read wherever they appear. A query carrying `OR` anywhere is left
+ * unfiltered, since a value under one arm constrains nothing on its own.
+ *
+ * A `NOT` leaves the columns it reaches unconstrained and the rest alone. A
+ * negated value names the partition the query does not want, and reading it as
+ * a constraint would answer from the wrong prefixes. A negation on any other
+ * column leaves the partition constraints as true as they were.
  *
  * Two constraints on one column are intersected, since a query carrying both
  * wants the rows they agree on.

package/dist/service/athena/table/sim-athena-partition-filters.js

@@ -1,12 +1,16 @@
+import { simAthenaNegatedColumns } from "./sim-athena-negated-columns.js";
 import { simAthenaSqlTokens } from "./sim-athena-sql-tokens.js";
 /**
  * The partition values a query's `WHERE` clause pins down.
  *
  * Only two shapes are read, `column = 'value'` and `column IN ('a', 'b')`, and
- * they are read wherever they appear. A query carrying `OR` or `NOT` anywhere
- * is left unfiltered. A value under one arm of an `OR` constrains nothing on
- * its own, and a negated one names the partition the query does not want, so
- * reading either as a constraint would answer from the wrong prefixes.
+ * they are read wherever they appear. A query carrying `OR` anywhere is left
+ * unfiltered, since a value under one arm constrains nothing on its own.
+ *
+ * A `NOT` leaves the columns it reaches unconstrained and the rest alone. A
+ * negated value names the partition the query does not want, and reading it as
+ * a constraint would answer from the wrong prefixes. A negation on any other
+ * column leaves the partition constraints as true as they were.
  *
  * Two constraints on one column are intersected, since a query carrying both
  * wants the rows they agree on.
@@ -52,6 +56,9 @@ export function simAthenaPartitionFilters(sql) {
             }
         }
     }
+    for (const name of simAthenaNegatedColumns(tokens)) {
+        byColumn.delete(name);
+    }
     return new SimAthenaPartitionFilters(byColumn);
 }
 /**
@@ -68,7 +75,7 @@ function narrow(byColumn, columnName, values) {
     byColumn.set(name, already.filter((value) => wanted.has(value)));
 }
 function isUnreadableTerm(token) {
-    return token.kind === "word" && (token.text === "or" || token.text === "not");
+    return token.kind === "word" && token.text === "or";
 }
 /**
  * Read `('a', 'b')` starting at its opening bracket.

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -9,6 +9,7 @@ import type { SimRoute53Registry } from "../../route53/registry/sim-route53-regi
 import type { SimKmsRegistry } from "../../kms/registry/sim-kms-registry.js";
 import { SimIam } from "../../iam/index.js";
 import type { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import type { SimIamServiceControlPolicyResolver } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
 import { type SimIamAccessKeyRegistry } from "../../iam/registry/sim-iam-access-key-registry.js";
 import type { SimAwsServiceHosts } from "../../../serve/controller/host/sim-aws-service-hosts.js";
 import type { SimAwsScopedServiceProperties } from "./sim-aws-scoped-service-properties.js";
@@ -23,6 +24,7 @@ interface SimAwsAccountServiceCacheProperties {
     readonly shadowableServiceHosts: SimAwsServiceHosts;
     readonly iamRegistry: SimIamRegistry;
     readonly accessKeyRegistry: SimIamAccessKeyRegistry;
+    readonly scpResolver: SimIamServiceControlPolicyResolver;
 }
 /**
  * Account-level cache for simulated AWS service instances.
@@ -52,6 +54,7 @@ export declare class SimAwsAccountServiceCache {
     private readonly cloudFrontRegistry;
     private readonly iamRegistry;
     private readonly accessKeyRegistry;
+    private readonly scpResolver;
     private readonly route53Registry;
     private readonly kmsRegistry;
     private readonly serviceHosts;

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -37,6 +37,7 @@ export class SimAwsAccountServiceCache {
     cloudFrontRegistry;
     iamRegistry;
     accessKeyRegistry;
+    scpResolver;
     route53Registry;
     kmsRegistry;
     serviceHosts;
@@ -55,6 +56,7 @@ export class SimAwsAccountServiceCache {
         this.acmRegistry = properties.acmRegistry;
         this.cloudFrontRegistry = properties.cloudFrontRegistry;
         this.iamRegistry = properties.iamRegistry;
+        this.scpResolver = properties.scpResolver;
         this.accessKeyRegistry = properties.accessKeyRegistry;
         this.route53Registry = properties.route53Registry;
         this.kmsRegistry = properties.kmsRegistry;
@@ -109,6 +111,9 @@ export class SimAwsAccountServiceCache {
                 // A cross-Account request is decided in both Accounts, so this IAM
                 // needs to be able to reach the IAM of the caller's own Account.
                 iamResolver: this.iamRegistry,
+                // What the Account's organization allows it to do is decided outside
+                // the Account, so IAM asks simulated Organizations about it.
+                scpResolver: this.scpResolver,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-service-factory.d.ts

@@ -22,6 +22,7 @@ import type { SimScheduler } from "../../scheduler/index.js";
 import type { SimElbV2 } from "../../elbv2/index.js";
 import type { SimIam } from "../../iam/index.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import { SimOrganizations } from "../../organizations/index.js";
 import type { SimFirehose } from "../../firehose/index.js";
 import type { SimGlue } from "../../glue/index.js";
 import type { SimKinesis } from "../../kinesis/index.js";
@@ -77,6 +78,14 @@ export declare class SimAwsServiceFactory {
      * instance so cross-account services can resolve Account-owned IAM state.
      */
     readonly iamRegistry: SimIamRegistry;
+    /**
+     * Simulated AWS Organizations for this simulation.
+     *
+     * An organization spans Accounts, so one belongs to the simulation rather
+     * than to any scope in it. Sim IAM reads the service control policies it
+     * holds when it decides a request.
+     */
+    readonly organizations: SimOrganizations;
     /**
      * Shared request authentication collaborators for this simulation.
      * @internal

package/dist/service/aws/factory/sim-aws-service-factory.js

@@ -1,5 +1,6 @@
 import { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import { SimOrganizations } from "../../organizations/index.js";
 import { SimLambdaUrlRegistry } from "../../lambda/registry/sim-lambda-url-registry.js";
 import { SimAwsAccountRegionServiceBuilder } from "./sim-aws-account-region-service-builder.js";
 import { SimAwsRegisteredServiceBuilder } from "./sim-aws-registered-service-builder.js";
@@ -40,6 +41,14 @@ export class SimAwsServiceFactory {
      * instance so cross-account services can resolve Account-owned IAM state.
      */
     iamRegistry = new SimIamRegistry();
+    /**
+     * Simulated AWS Organizations for this simulation.
+     *
+     * An organization spans Accounts, so one belongs to the simulation rather
+     * than to any scope in it. Sim IAM reads the service control policies it
+     * holds when it decides a request.
+     */
+    organizations = new SimOrganizations();
     /**
      * Shared request authentication collaborators for this simulation.
      * @internal
@@ -94,6 +103,7 @@ export class SimAwsServiceFactory {
             shadowableServiceHosts: this.registries.shadowableServiceHosts,
             iamRegistry: this.iamRegistry,
             accessKeyRegistry: this.requestAuth.accessKeyRegistry,
+            scpResolver: this.organizations,
         });
         this.accountRegionServices = new SimAwsAccountRegionServiceBuilder({
             simAws: properties.simAws,