@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/organizations/tree/sim-organizations-tree.js

@@ -0,0 +1,154 @@
+import { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, SimOrganizationsRoot, } from "./sim-organizations-node.js";
+/**
+ * Thrown for an organizational unit this organization has never seen.
+ */
+export class SimOrganizationsUnknownNode extends Error {
+    constructor(nodeId) {
+        super(`Unknown simulated Organizations node "${nodeId}"`);
+        this.name = "SimOrganizationsUnknownNode";
+    }
+}
+/**
+ * Where the Accounts and organizational units of one simulated organization
+ * sit relative to each other.
+ *
+ * The tree answers one question for authorization: which nodes lie on the path
+ * from the root down to an Account. Every policy on that path applies to the
+ * Account, which is what makes an organizational unit worth modelling at all.
+ *
+ * An Account joins the organization the moment it is named, whether by being
+ * moved into a unit or by having a policy attached to it. An Account never
+ * named sits outside the organization and is unrestricted.
+ */
+export class SimOrganizationsTree {
+    root = new SimOrganizationsRoot(makeSimOrganizationsRootId());
+    organizationalUnits = new Map();
+    accountParents = new Map();
+    /**
+     * Create an organizational unit, under the root unless another unit is
+     * named as its parent.
+     */
+    createOrganizationalUnit(name, parentId = this.root.id) {
+        this.requireKnown(parentId);
+        const unit = new SimOrganizationsOrganizationalUnit(makeSimOrganizationsOrganizationalUnitId(this.root.id), name, parentId);
+        this.organizationalUnits.set(unit.id, unit);
+        return unit;
+    }
+    /**
+     * Place an Account under a node, joining the organization if it was outside
+     * it.
+     */
+    placeAccount(accountId, parentId = this.root.id) {
+        this.requireKnown(parentId);
+        this.accountParents.set(accountId, parentId);
+    }
+    /**
+     * Take an Account out of the organization.
+     */
+    removeAccount(accountId) {
+        this.accountParents.delete(accountId);
+    }
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Whatever still sits under it moves up to its parent, which is the only
+     * answer that leaves every Account on a path back to the root. AWS refuses
+     * to delete a unit that still holds anything, and a Stack tears down in
+     * reverse dependency order, so nothing should still be there.
+     */
+    removeOrganizationalUnit(unitId) {
+        const unit = this.organizationalUnits.get(unitId);
+        if (unit === undefined) {
+            return;
+        }
+        this.organizationalUnits.delete(unitId);
+        this.reparent(unitId, unit.parentId);
+    }
+    /**
+     * Every Account in the organization.
+     */
+    accountIds() {
+        return this.accountParents.keys().toArray();
+    }
+    /**
+     * Whether this Account is in the organization.
+     */
+    holds(accountId) {
+        return this.accountParents.has(accountId);
+    }
+    /**
+     * Refuse a root or organizational unit this organization never created.
+     *
+     * A handle from another simulated organization would otherwise be attached
+     * to and then never read, because no Account here has it on its path. A
+     * policy that silently applies to nothing is worse than a refusal.
+     */
+    requireNode(nodeId) {
+        this.requireKnown(nodeId);
+    }
+    /**
+     * Whether this organization has a root or unit under an id.
+     */
+    hasNode(nodeId) {
+        return nodeId === this.root.id || this.organizationalUnits.has(nodeId);
+    }
+    /**
+     * The nodes a request against an Account is filtered by, root first.
+     *
+     * The Account itself is the last of them, because a policy attached to an
+     * Account applies alongside the ones it inherits.
+     */
+    pathTo(accountId) {
+        const parentId = this.accountParents.get(accountId);
+        if (parentId === undefined) {
+            return [];
+        }
+        return [...this.ancestors(parentId), accountId];
+    }
+    /**
+     * What to call a node in a denial.
+     */
+    nameOf(nodeId) {
+        if (nodeId === this.root.id) {
+            return this.root.name;
+        }
+        return this.organizationalUnits.get(nodeId)?.name ?? String(nodeId);
+    }
+    /**
+     * Move everything under one node up to another.
+     */
+    reparent(fromId, toId) {
+        for (const [accountId, parentId] of this.accountParents) {
+            if (parentId === fromId) {
+                this.accountParents.set(accountId, toId);
+            }
+        }
+        const orphaned = this.organizationalUnits
+            .values()
+            .filter((unit) => unit.parentId === fromId)
+            .toArray();
+        for (const unit of orphaned) {
+            this.organizationalUnits.set(unit.id, new SimOrganizationsOrganizationalUnit(unit.id, unit.name, toId));
+        }
+    }
+    /**
+     * The nodes from the root down to one node, root first.
+     */
+    ancestors(nodeId) {
+        const path = [];
+        let currentId = nodeId;
+        while (currentId !== undefined && currentId !== this.root.id) {
+            path.unshift(currentId);
+            currentId = this.organizationalUnits.get(currentId)?.parentId;
+        }
+        return [this.root.id, ...path];
+    }
+    /**
+     * Refuse a node this organization never created.
+     */
+    requireKnown(nodeId) {
+        if (nodeId !== this.root.id && !this.organizationalUnits.has(nodeId)) {
+            throw new SimOrganizationsUnknownNode(nodeId);
+        }
+    }
+}

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets-authorizer.js

@@ -33,6 +33,7 @@ export class ChangeResourceRecordSetsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ChangeResourceRecordSetsAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.js

@@ -29,6 +29,7 @@ export class CreateHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateHostedZoneAuthorizer.action,
                 resource: CreateHostedZoneAuthorizer.resource,
             });

package/dist/service/route53/command/delete-hosted-zone/delete-hosted-zone-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteHostedZoneAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.js

@@ -22,6 +22,7 @@ export class SimRoute53DnssecAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.js

@@ -31,6 +31,7 @@ export class GetHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetHostedZoneAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/list-hosted-zones-by-name/list-hosted-zones-by-name-authorizer.js

@@ -30,6 +30,7 @@ export class ListHostedZonesByNameAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListHostedZonesByNameAuthorizer.action,
                 resource: ListHostedZonesByNameAuthorizer.resource,
             });

package/dist/service/route53/command/list-resource-record-sets/list-resource-record-sets-authorizer.js

@@ -33,6 +33,7 @@ export class ListResourceRecordSetsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListResourceRecordSetsAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/s3/command/create-bucket/create-bucket.handler.js

@@ -44,6 +44,7 @@ export class CreateBucketCommandHandler {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: "s3:CreateBucket",
                 resource,
             });

package/dist/service/s3/command/delete-bucket/delete-bucket-authorizer.js

@@ -30,6 +30,7 @@ export class DeleteBucketAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteBucketAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/delete-bucket-policy/delete-bucket-policy-authorizer.js

@@ -29,6 +29,7 @@ export class DeleteBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/delete-object/delete-object-authorizer.js

@@ -38,6 +38,7 @@ export class DeleteObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteObjectAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.js

@@ -26,6 +26,7 @@ export class GetBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/get-object/get-object-authorizer.js

@@ -41,6 +41,7 @@ export class GetObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetObjectAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/head-bucket/head-bucket-authorizer.js

@@ -39,6 +39,7 @@ export class HeadBucketAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: HeadBucketAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/lifecycle/sim-s3-lifecycle-authorizer.js

@@ -42,6 +42,7 @@ export class SimS3LifecycleAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/list-buckets/list-buckets-authorizer.js

@@ -37,6 +37,7 @@ export class ListBucketsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListBucketsAuthorizer.action,
                 resource: ListBucketsAuthorizer.resource,
             });

package/dist/service/s3/command/list-objects/list-objects-authorizer.js

@@ -48,6 +48,7 @@ export class ListObjectsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListObjectsAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/multipart/sim-s3-multipart-authorizer.js

@@ -42,6 +42,7 @@ export class SimS3MultipartAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: SimS3MultipartAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/notification/sim-s3-notification-authorizer.js

@@ -43,6 +43,7 @@ export class SimS3NotificationAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js

@@ -41,6 +41,7 @@ export class SimS3PublicAccessBlockAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.js

@@ -23,6 +23,7 @@ export class PutBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.js

@@ -40,6 +40,7 @@ export class PutBucketWebsiteAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutBucketWebsiteAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/put-object/put-object-authorizer.js

@@ -41,6 +41,7 @@ export class PutObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutObjectAuthorizer.action,
                 resource,
             });

package/dist/service/secretsmanager/command/authorize/sim-secrets-manager-authorizer.js

@@ -38,6 +38,7 @@ export class SimSecretsManagerAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/ses/command/authorize/sim-ses-authorizer.js

@@ -78,6 +78,7 @@ export class SimSesAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/sqs/command/authorize/sim-sqs-authorizer.js

@@ -69,6 +69,7 @@ export class SimSqsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: input.action,
                 resource: input.resource,
             });

package/dist/service/ssm/command/authorize/sim-ssm-authorizer.js

@@ -55,6 +55,7 @@ export class SimSsmAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/wafv2/command/authorize/sim-wafv2-authorizer.js

@@ -34,6 +34,7 @@ export class SimWafAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/wafv2/command/ip-set/sim-wafv2-ip-set-commands.js

@@ -1,7 +1,7 @@
 import { SimWafIpSet, requiredSimWafIpAddressVersion, } from "../../ip-set/sim-waf-ip-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { refuseSimWafTags, requiredSimWafName } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove IP sets.
@@ -29,7 +29,7 @@ export class SimWafIpSetCommands {
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
-            description: input.Description,
+            description: checkedSimWafDescription(input.Description),
             ipAddressVersion: requiredSimWafIpAddressVersion(input.IPAddressVersion),
             addresses: input.Addresses ?? [],
         });
@@ -59,10 +59,11 @@ export class SimWafIpSetCommands {
      */
     updateIpSet(command, options) {
         const { input } = command;
+        const description = checkedSimWafDescription(input.Description);
         const ipSet = this.require(input, "wafv2:UpdateIPSet", options);
         ipSet.replaceAddresses({
             addresses: input.Addresses ?? [],
-            description: input.Description,
+            description,
             lockToken: input.LockToken,
         });
         return { $metadata: {}, NextLockToken: ipSet.lockToken };

package/dist/service/wafv2/command/regex-pattern-set/sim-wafv2-regex-pattern-set-commands.js

@@ -1,7 +1,7 @@
 import { SimWafRegexPatternSet } from "../../regex-pattern-set/sim-waf-regex-pattern-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { refuseSimWafTags, requiredSimWafName } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove regex pattern sets.
@@ -29,7 +29,7 @@ export class SimWafRegexPatternSetCommands {
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
-            description: input.Description,
+            description: checkedSimWafDescription(input.Description),
             regularExpressions: input.RegularExpressionList ?? [],
         });
         this.#authorizer.authorizeResource("wafv2:CreateRegexPatternSet", patternSet.arn, options?.caller);
@@ -66,10 +66,11 @@ export class SimWafRegexPatternSetCommands {
      */
     updateRegexPatternSet(command, options) {
         const { input } = command;
+        const description = checkedSimWafDescription(input.Description);
         const patternSet = this.require(input, "wafv2:UpdateRegexPatternSet", options);
         patternSet.replaceExpressions({
             regularExpressions: input.RegularExpressionList ?? [],
-            description: input.Description,
+            description,
             lockToken: input.LockToken,
         });
         return { $metadata: {}, NextLockToken: patternSet.lockToken };

package/dist/service/wafv2/command/sim-wafv2-input.d.ts

@@ -24,3 +24,18 @@ export declare function refuseSimWafTags(tags: readonly unknown[] | undefined, o
  * by ARN, and neither has anything else to fall back on.
  */
 export declare function requiredSimWafArn(arn: string | undefined, parameter: string): string;
+/**
+ * Read the description a write gave, refusing one WAFv2 will not store.
+ *
+ * The empty string is the one worth catching. Code that reads a resource,
+ * changes part of it and writes the rest back hands the description straight
+ * through, and AWS answers `""` for some resources nobody has described. WAFv2
+ * refuses that write. A simulation that took it would leave the failure for
+ * the account to report.
+ *
+ * The two constraints are checked apart because AWS checks them apart. The
+ * pattern matches three characters at the shortest. `ab` is long enough for
+ * the length and still refused, and `""` fails both at once, which is how one
+ * message comes to report two errors.
+ */
+export declare function checkedSimWafDescription(description: string | undefined): string | undefined;

package/dist/service/wafv2/command/sim-wafv2-input.js

@@ -1,4 +1,4 @@
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, SimWafValidationException, } from "../error/sim-wafv2.error.js";
 /**
  * Read the name a request named, refusing a request with none.
  */
@@ -47,3 +47,68 @@ export function requiredSimWafArn(arn, parameter) {
     }
     return arn;
 }
+/**
+ * The shape WAFv2 documents for the description of a web ACL, an IP set and a
+ * regex pattern set.
+ *
+ * The refusal below quotes this expression back, the way WAFv2 quotes its own.
+ * WAFv2 writes the dots inside the character classes escaped and this does
+ * not, which is the same set of characters written two ways.
+ */
+const descriptionExpression = /^[\w+=:#@/\-,.][\w+=:#@/\-,.\s]+[\w+=:#@/\-,.]$/;
+const descriptionMaxLength = 256;
+/**
+ * Read the description a write gave, refusing one WAFv2 will not store.
+ *
+ * The empty string is the one worth catching. Code that reads a resource,
+ * changes part of it and writes the rest back hands the description straight
+ * through, and AWS answers `""` for some resources nobody has described. WAFv2
+ * refuses that write. A simulation that took it would leave the failure for
+ * the account to report.
+ *
+ * The two constraints are checked apart because AWS checks them apart. The
+ * pattern matches three characters at the shortest. `ab` is long enough for
+ * the length and still refused, and `""` fails both at once, which is how one
+ * message comes to report two errors.
+ */
+export function checkedSimWafDescription(description) {
+    if (description === undefined) {
+        return undefined;
+    }
+    const failures = [
+        ...lengthFailures(description),
+        ...patternFailures(description),
+    ];
+    if (failures.length === 0) {
+        return description;
+    }
+    throw new SimWafValidationException(`${failures.length} validation error${failures.length === 1 ? "" : "s"} detected: ${failures
+        .map((failure) => `Value '${description}' at 'description' failed to satisfy ` +
+        `constraint: ${failure}`)
+        .join("; ")}`);
+}
+/**
+ * What the length of a description falls foul of, if anything.
+ */
+function lengthFailures(description) {
+    if (description.length === 0) {
+        return ["Member must have length greater than or equal to 1"];
+    }
+    if (description.length > descriptionMaxLength) {
+        return [
+            `Member must have length less than or equal to ${descriptionMaxLength}`,
+        ];
+    }
+    return [];
+}
+/**
+ * What the shape of a description falls foul of, if anything.
+ */
+function patternFailures(description) {
+    if (descriptionExpression.test(description)) {
+        return [];
+    }
+    return [
+        `Member must satisfy regular expression pattern: ${descriptionExpression.source}`,
+    ];
+}

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.js

@@ -2,7 +2,7 @@ import { SimWafAssociatedItemException } from "../../error/sim-wafv2.error.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { requiredSimWafName } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource, } from "../sim-wafv2-resource-lookup.js";
 import { refuseUnsimulatedSimWafWebAclInput } from "./sim-wafv2-unsimulated-web-acl-input.js";
 import { simWafWebAclOutput } from "./sim-waf-web-acl-output.js";
@@ -38,12 +38,13 @@ export class SimWafWebAclCommands {
         const name = requiredSimWafName(input.Name);
         const scope = requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName);
         refuseUnsimulatedSimWafWebAclInput(input, "CreateWebACL");
+        const configuration = configurationOf(input);
         const webAcl = new SimWafWebAcl({
             name,
             scope,
             accountRegionScope: this.#accountRegionScope,
-            description: input.Description,
-            configuration: configurationOf(input),
+            description: configuration.description,
+            configuration,
             regexPatternSets: this.#regexPatternSets,
             managedRules: this.#managedRules,
             clock: this.#clock,
@@ -68,8 +69,9 @@ export class SimWafWebAclCommands {
     updateWebAcl(command, options) {
         const { input } = command;
         refuseUnsimulatedSimWafWebAclInput(input, "UpdateWebACL");
+        const configuration = configurationOf(input);
         const webAcl = this.require(input, "wafv2:UpdateWebACL", options);
-        webAcl.reconfigure(configurationOf(input), input.LockToken);
+        webAcl.reconfigure(configuration, input.LockToken);
         return { $metadata: {}, NextLockToken: webAcl.lockToken };
     }
     /**
@@ -134,6 +136,6 @@ function configurationOf(input) {
         rules: input.Rules,
         customResponseBodies: input.CustomResponseBodies,
         visibilityConfig: input.VisibilityConfig,
-        description: input.Description,
+        description: checkedSimWafDescription(input.Description),
     };
 }

package/dist/service/wafv2/error/sim-wafv2.error.d.ts

@@ -89,6 +89,17 @@ export declare class SimWafAssociatedItemException extends SimWafError {
     readonly name = "WAFAssociatedItemException";
     constructor(message: string);
 }
+/**
+ * Simulated WAFv2 ValidationException error.
+ *
+ * WAFv2 checks the length and shape of a few members before the request
+ * reaches the rest of the API, and reports every failure in one message. A
+ * description of `""` fails two of those checks at once.
+ */
+export declare class SimWafValidationException extends SimWafError {
+    readonly name = "ValidationException";
+    constructor(message: string);
+}
 /**
  * A match declared against this simulation that it cannot answer with.
  *

package/dist/service/wafv2/error/sim-wafv2.error.js

@@ -100,6 +100,19 @@ export class SimWafAssociatedItemException extends SimWafError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated WAFv2 ValidationException error.
+ *
+ * WAFv2 checks the length and shape of a few members before the request
+ * reaches the rest of the API, and reports every failure in one message. A
+ * description of `""` fails two of those checks at once.
+ */
+export class SimWafValidationException extends SimWafError {
+    name = "ValidationException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 /**
  * A match declared against this simulation that it cannot answer with.
  *