@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,40 +1,50 @@
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
-import { SimIamAllowStatements } from "./allow/sim-iam-allow-statements.js";
-export const SimIamPolicyDecisionValue = {
-    ExplicitDeny: "ExplicitDeny",
-    Allow: "Allow",
-    ImplicitDeny: "ImplicitDeny",
-};
+import { SimIamPolicyEvaluation } from "./allow/sim-iam-policy-evaluation.js";
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export class SimIamPolicyDecision {
     request;
-    policyDocumentParser;
-    statementMatcher;
-    explicitDenyStatementRecords = [];
-    allows = new SimIamAllowStatements();
+    policies;
+    scpGate;
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
+        const statementMatcher = new SimIamPolicyStatementMatcher(request);
         this.request = request;
-        this.policyDocumentParser = policyDocumentParser;
-        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
-        this.evaluate();
+        this.policies = new SimIamPolicyEvaluation({
+            policies: [...request.identityPolicies, ...request.resourcePolicies],
+            policyDocumentParser,
+            statementMatcher,
+        });
+        this.scpGate = new SimIamScpGate({
+            serviceControlPolicies: request.serviceControlPolicies,
+            policyDocumentParser,
+            statementMatcher,
+        });
     }
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -49,13 +59,15 @@ export class SimIamPolicyDecision {
      * Final IAM decision value.
      */
     get value() {
-        if (this.explicitDenyStatementRecords.length > 0) {
+        if (this.policies.isExplicitDeny) {
             return SimIamPolicyDecisionValue.ExplicitDeny;
         }
-        if (this.request.allowRequirement.isSatisfiedBy(this.allows.sides)) {
-            return SimIamPolicyDecisionValue.Allow;
+        if (this.scpGate.value !== undefined) {
+            return this.scpGate.value;
         }
-        return SimIamPolicyDecisionValue.ImplicitDeny;
+        return this.request.allowRequirement.isSatisfiedBy(this.policies.sides)
+            ? SimIamPolicyDecisionValue.Allow
+            : SimIamPolicyDecisionValue.ImplicitDeny;
     }
     /**
      * Whether the request is allowed.
@@ -87,13 +99,38 @@ export class SimIamPolicyDecision {
      * An identity-policy Allow cannot substitute for the target role's trust.
      */
     get isAllowedByTrustPolicy() {
-        return this.allows.trust.length > 0;
+        return this.policies.allowStatements.trust.length > 0;
     }
     /**
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements() {
-        return this.explicitDenyStatementRecords;
+        return this.policies.explicitDenyStatements;
+    }
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy() {
+        return this.scpGate;
+    }
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason() {
+        if (this.policies.isExplicitDeny) {
+            return undefined;
+        }
+        return this.scpGate.denialReason(this.request.action);
     }
     /**
      * Matching Allow statements, from both policy sides.
@@ -103,46 +140,24 @@ export class SimIamPolicyDecision {
      * from each side.
      */
     get allowStatements() {
-        return this.allows.all;
+        return this.policies.allowStatements.all;
     }
     /**
      * Matching Allow statements from identity-based policies.
      */
     get identityAllowStatements() {
-        return this.allows.identity;
+        return this.policies.allowStatements.identity;
     }
     /**
      * Matching Allow statements from resource-based policies.
      */
     get resourceAllowStatements() {
-        return this.allows.resource;
+        return this.policies.allowStatements.resource;
     }
     /**
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements() {
-        return this.allows.trust;
-    }
-    evaluate() {
-        for (const policy of [
-            ...this.request.identityPolicies,
-            ...this.request.resourcePolicies,
-        ]) {
-            this.evaluatePolicy(policy);
-        }
-    }
-    evaluatePolicy(policy) {
-        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
-        for (const statement of parsedPolicy.statements) {
-            const principal = this.statementMatcher.matches(policy, statement);
-            if (!principal.matched) {
-                continue;
-            }
-            if (statement.effect === "Deny") {
-                this.explicitDenyStatementRecords.push(statement.source);
-                continue;
-            }
-            this.allows.record(policy, statement.source, principal);
-        }
+        return this.policies.allowStatements.trust;
     }
 }

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.d.ts

@@ -15,6 +15,14 @@ export interface SimIamAuthorizationDecision {
     readonly caller: SimAwsResolvedCaller;
     readonly isAllowed: boolean;
     readonly isDenied: boolean;
+    /**
+     * How an AccessDenied error should explain this denial, where the action and
+     * the resource leave something out.
+     *
+     * A service control policy denial is the case this exists for. Absent for a
+     * denial an identity or resource policy accounts for on its own.
+     */
+    readonly denialReason?: string | undefined;
 }
 /**
  * IAM authorization capability consumed by other simulated AWS services.

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.js

@@ -32,6 +32,7 @@ export class SimIamAllowAllAuth {
             caller,
             isAllowed: true,
             isDenied: false,
+            denialReason: undefined,
         };
     }
 }

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -19,6 +19,14 @@ export interface SimIamAccessDeniedInput {
     readonly principal: SimAwsPrincipal;
     readonly action: string;
     readonly resource: string;
+    /**
+     * What else the message should say about why the request was denied.
+     *
+     * AWS names the source of a denial when it is something beyond the caller's
+     * own permissions, such as a service control policy. A denial the caller's
+     * identity and resource policies account for adds nothing here.
+     */
+    readonly reason?: string | undefined;
 }
 /**
  * Simulated IAM AccessDenied error.

package/dist/service/iam/error/sim-iam.error.js

@@ -27,7 +27,8 @@ export class SimIamAccessDenied extends SimIamError {
     constructor(input) {
         const iamCallerIdentifier = new SimIamCallerIdentifier();
         const callerIdentifier = iamCallerIdentifier.format(input.principal);
-        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}`, { httpStatusCode: 403 });
+        const reason = input.reason === undefined ? "" : ` ${input.reason}`;
+        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}${reason}`, { httpStatusCode: 403 });
         this.caller = input.principal;
         this.action = input.action;
         this.resource = input.resource;

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -10,6 +10,7 @@ import { SimIamSessionManager } from "./credential/session/sim-iam-session-manag
 import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimIamAccountResolver } from "./registry/sim-iam-account-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "./authorize/scp/sim-iam-scp-resolver.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
 export interface SimIamProperties {
@@ -26,6 +27,14 @@ export interface SimIamProperties {
      * simulation around it and so leaves this out.
      */
     readonly iamResolver?: SimIamAccountResolver;
+    /**
+     * Resolves the service control policies in force for this Account.
+     *
+     * Simulated Organizations supplies this when a SimAws builds IAM. A
+     * standalone SimIam has no organization around it, which is the same as an
+     * Account belonging to none.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver;
 }
 /**
  * The state and collaborators of one simulated IAM Account.

package/dist/service/iam/sim-iam-account-parts.js

@@ -48,6 +48,7 @@ export class SimIamAccountParts {
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/kinesis/command/authorize/sim-kinesis-authorizer.js

@@ -37,6 +37,7 @@ export class SimKinesisAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -45,6 +45,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource: key.arn,
             });
@@ -65,6 +66,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/lambda/command/create-function/create-function-authorizer.js

@@ -27,6 +27,7 @@ export class CreateFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/delete-function/delete-function-authorizer.js

@@ -23,6 +23,7 @@ export class DeleteFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/event-invoke-config/event-invoke-config-authorizer.js

@@ -30,6 +30,7 @@ export class EventInvokeConfigAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/function-url/function-url-authorizer.js

@@ -30,6 +30,7 @@ export class FunctionUrlAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/get-function/get-function-authorizer.js

@@ -27,6 +27,7 @@ export class GetFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/invoke/invoke-authorizer.js

@@ -37,6 +37,7 @@ export class InvokeAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: InvokeAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/list-functions/list-functions-authorizer.js

@@ -32,6 +32,7 @@ export class ListFunctionsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListFunctionsAuthorizer.action,
                 resource: ListFunctionsAuthorizer.resource,
             });

package/dist/service/lambda/command/update-function-code/update-function-code-authorizer.js

@@ -28,6 +28,7 @@ export class UpdateFunctionCodeAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateFunctionCodeAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.js

@@ -29,6 +29,7 @@ export class UpdateFunctionConfigurationAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateFunctionConfigurationAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/version/version-authorizer.js

@@ -30,6 +30,7 @@ export class VersionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/logs/command/authorize/sim-logs-authorizer.js

@@ -52,6 +52,7 @@ export class SimLogsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/organizations/cfn/sim-cfn-organization-creator.d.ts

@@ -0,0 +1,19 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganization } from "./sim-cfn-organizations-record.js";
+/**
+ * Records the organization an `AWS::Organizations::Organization` declares.
+ *
+ * A SimAws already has one organization, so this brings nothing into being.
+ * The Resource earns its place by answering `RootId`, which is what the rest
+ * of a template hangs off.
+ */
+export declare class SimCfnOrganizationCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Record the organization a template declares.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganization;
+}

package/dist/service/organizations/cfn/sim-cfn-organization-creator.js

@@ -0,0 +1,25 @@
+import { SimCfnOrganization } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Records the organization an `AWS::Organizations::Organization` declares.
+ *
+ * A SimAws already has one organization, so this brings nothing into being.
+ * The Resource earns its place by answering `RootId`, which is what the rest
+ * of a template hangs off.
+ */
+export class SimCfnOrganizationCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Record the organization a template declares.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Organization");
+        const featureSet = properties["FeatureSet"];
+        values.ignore(featureSet, "FeatureSet", "Simulated Organizations evaluates service control policies whatever " +
+            "the feature set says");
+        return new SimCfnOrganization(this.#simAws.organizations().root().id, values.optionalString(featureSet) ?? "ALL", this.#simAws.defaultAccountId);
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizational-unit-creator.d.ts

@@ -0,0 +1,16 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimOrganizationsOrganizationalUnit } from "../tree/sim-organizations-node.js";
+/**
+ * Creates organizational units from
+ * `AWS::Organizations::OrganizationalUnit` Resources.
+ */
+export declare class SimCfnOrganizationalUnitCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Create a unit under the node its `ParentId` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimOrganizationsOrganizationalUnit;
+}

package/dist/service/organizations/cfn/sim-cfn-organizational-unit-creator.js

@@ -0,0 +1,21 @@
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Creates organizational units from
+ * `AWS::Organizations::OrganizationalUnit` Resources.
+ */
+export class SimCfnOrganizationalUnitCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Create a unit under the node its `ParentId` names.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::OrganizationalUnit");
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no unit tags");
+        return this.#simAws
+            .organizations()
+            .createOrganizationalUnit(values.requiredString(properties["Name"], "Name"), values.requiredString(properties["ParentId"], "ParentId"));
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-account-creator.d.ts

@@ -0,0 +1,20 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganizationsAccount } from "./sim-cfn-organizations-record.js";
+/**
+ * Puts Accounts in the organization from `AWS::Organizations::Account`
+ * Resources.
+ *
+ * AWS creates a new account here and gives it an id nobody chose, so this does
+ * the same. A template reads that id back with `Ref` or with
+ * `Fn::GetAtt AccountId`.
+ */
+export declare class SimCfnOrganizationsAccountCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Create an Account under the first node its `ParentIds` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganizationsAccount;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-account-creator.js

@@ -0,0 +1,34 @@
+import { makeSimAwsAccountId } from "../../aws/sim-aws-account.js";
+import { SimCfnOrganizationsAccount } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsProperties } from "./sim-cfn-organizations-properties.js";
+/**
+ * Puts Accounts in the organization from `AWS::Organizations::Account`
+ * Resources.
+ *
+ * AWS creates a new account here and gives it an id nobody chose, so this does
+ * the same. A template reads that id back with `Ref` or with
+ * `Fn::GetAtt AccountId`.
+ */
+export class SimCfnOrganizationsAccountCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Create an Account under the first node its `ParentIds` names.
+     */
+    create(resource, properties) {
+        const values = new SimCfnOrganizationsProperties(resource, "AWS::Organizations::Account");
+        values.ignore(properties["Tags"], "Tags", "Simulated Organizations reads no Account tags");
+        values.ignore(properties["RoleName"], "RoleName", "Simulated Organizations creates no cross-account access Role");
+        // Everything the Resource needs is read before the organization changes.
+        // A property that fails after the Account was placed would leave it in the
+        // organization with no record for a teardown to take it out again.
+        const accountName = values.requiredString(properties["AccountName"], "AccountName");
+        const email = values.requiredString(properties["Email"], "Email");
+        const parentId = values.stringList(properties["ParentIds"])[0];
+        const accountId = makeSimAwsAccountId();
+        this.#simAws.organizations().moveAccount(accountId, parentId);
+        return new SimCfnOrganizationsAccount(accountId, accountName, email, this.#simAws.now());
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-creator.d.ts

@@ -0,0 +1,21 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganizationsPolicy } from "./sim-cfn-organizations-record.js";
+/**
+ * Attaches service control policies from `AWS::Organizations::Policy`
+ * Resources to the nodes they target.
+ *
+ * A policy of any other type is refused as an unsupported Resource, so the
+ * Stack records it and deploys on. Simulated Organizations evaluates service
+ * control policies and nothing else, and a tag policy stored here would look
+ * like one that does something.
+ */
+export declare class SimCfnOrganizationsPolicyCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Attach a policy to every node its `TargetIds` names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganizationsPolicy;
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-creator.js

@@ -0,0 +1,40 @@
+import { makeSimOrganizationsPolicyId, } from "../tree/sim-organizations-node.js";
+import { SimCfnOrganizationsPolicy } from "./sim-cfn-organizations-record.js";
+import { SimCfnOrganizationsPolicyInput } from "./sim-cfn-organizations-policy-input.js";
+/**
+ * Attaches service control policies from `AWS::Organizations::Policy`
+ * Resources to the nodes they target.
+ *
+ * A policy of any other type is refused as an unsupported Resource, so the
+ * Stack records it and deploys on. Simulated Organizations evaluates service
+ * control policies and nothing else, and a tag policy stored here would look
+ * like one that does something.
+ */
+export class SimCfnOrganizationsPolicyCreator {
+    #simAws;
+    constructor(simAws) {
+        this.#simAws = simAws;
+    }
+    /**
+     * Attach a policy to every node its `TargetIds` names.
+     */
+    create(resource, properties) {
+        const input = new SimCfnOrganizationsPolicyInput(resource, properties);
+        const organizations = this.#simAws.organizations();
+        // Every target is resolved before any of them is attached to. Refusing one
+        // partway through would leave the earlier targets holding a policy no
+        // teardown knows about.
+        organizations.requireTargets(input.targetIds);
+        // An id of its own, rather than one derived from the logical id. Two
+        // Stacks can each declare a Policy called the same thing, and a shared id
+        // would let one Stack's teardown take the other's policy off.
+        const policyId = makeSimOrganizationsPolicyId();
+        for (const targetId of input.targetIds) {
+            organizations.attachServiceControlPolicy(targetId, input.document, {
+                policyName: input.name,
+                policyId,
+            });
+        }
+        return new SimCfnOrganizationsPolicy(policyId, input.name, input.policyType, input.targetIds);
+    }
+}

package/dist/service/organizations/cfn/sim-cfn-organizations-policy-input.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * What an `AWS::Organizations::Policy` Resource asks for.
+ *
+ * Every property is read here before the creator changes anything, so a
+ * Resource that cannot be satisfied fails with the organization untouched.
+ */
+export declare class SimCfnOrganizationsPolicyInput {
+    readonly name: string;
+    readonly document: SimIamPolicyDocument;
+    readonly targetIds: readonly string[];
+    constructor(resource: SimCfnResource, properties: SimCfnTemplateValueRecord);
+    /**
+     * The policy type this Resource carries, which is the only one simulated
+     * Organizations evaluates.
+     */
+    get policyType(): string;
+}