@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/acm/command/delete-certificate/delete-certificate-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteCertificateAuthorizer.action,
                 resource: certificateArn,
             });

package/dist/service/acm/command/describe-certificate/describe-certificate-authorizer.js

@@ -32,6 +32,7 @@ export class DescribeCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DescribeCertificateAuthorizer.action,
                 resource: certificateArn,
             });

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.js

@@ -32,6 +32,7 @@ export class ListCertificatesAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListCertificatesAuthorizer.action,
                 resource: ListCertificatesAuthorizer.resource,
             });

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.js

@@ -29,6 +29,7 @@ export class RequestCertificateAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: RequestCertificateAuthorizer.action,
                 resource: this.resource,
             });

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js

@@ -49,6 +49,9 @@ export class SimRestApiAuthorizerPolicy {
                 },
             ],
             resourcePolicies: [],
+            // An authorizer's policy document is evaluated on its own. No Account
+            // boundary is being crossed here, so no service control policy applies.
+            serviceControlPolicies: { applies: false, levels: [] },
             allowRequirement: new SimIamEitherSideAllowRequirement(),
             action: simExecuteApiInvokeAction,
             resource: methodArn,

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js

@@ -39,6 +39,9 @@ export class SimHttpApiAuthorizerPolicy {
                 },
             ],
             resourcePolicies: [],
+            // An authorizer's policy document is evaluated on its own. No Account
+            // boundary is being crossed here, so no service control policy applies.
+            serviceControlPolicies: { applies: false, levels: [] },
             allowRequirement: new SimIamEitherSideAllowRequirement(),
             action: simExecuteApiInvokeAction,
             resource: routeArn,

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -9,6 +9,7 @@ import type { SimRoute53Registry } from "../../route53/registry/sim-route53-regi
 import type { SimKmsRegistry } from "../../kms/registry/sim-kms-registry.js";
 import { SimIam } from "../../iam/index.js";
 import type { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import type { SimIamServiceControlPolicyResolver } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
 import { type SimIamAccessKeyRegistry } from "../../iam/registry/sim-iam-access-key-registry.js";
 import type { SimAwsServiceHosts } from "../../../serve/controller/host/sim-aws-service-hosts.js";
 import type { SimAwsScopedServiceProperties } from "./sim-aws-scoped-service-properties.js";
@@ -23,6 +24,7 @@ interface SimAwsAccountServiceCacheProperties {
     readonly shadowableServiceHosts: SimAwsServiceHosts;
     readonly iamRegistry: SimIamRegistry;
     readonly accessKeyRegistry: SimIamAccessKeyRegistry;
+    readonly scpResolver: SimIamServiceControlPolicyResolver;
 }
 /**
  * Account-level cache for simulated AWS service instances.
@@ -52,6 +54,7 @@ export declare class SimAwsAccountServiceCache {
     private readonly cloudFrontRegistry;
     private readonly iamRegistry;
     private readonly accessKeyRegistry;
+    private readonly scpResolver;
     private readonly route53Registry;
     private readonly kmsRegistry;
     private readonly serviceHosts;

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -37,6 +37,7 @@ export class SimAwsAccountServiceCache {
     cloudFrontRegistry;
     iamRegistry;
     accessKeyRegistry;
+    scpResolver;
     route53Registry;
     kmsRegistry;
     serviceHosts;
@@ -55,6 +56,7 @@ export class SimAwsAccountServiceCache {
         this.acmRegistry = properties.acmRegistry;
         this.cloudFrontRegistry = properties.cloudFrontRegistry;
         this.iamRegistry = properties.iamRegistry;
+        this.scpResolver = properties.scpResolver;
         this.accessKeyRegistry = properties.accessKeyRegistry;
         this.route53Registry = properties.route53Registry;
         this.kmsRegistry = properties.kmsRegistry;
@@ -109,6 +111,9 @@ export class SimAwsAccountServiceCache {
                 // A cross-Account request is decided in both Accounts, so this IAM
                 // needs to be able to reach the IAM of the caller's own Account.
                 iamResolver: this.iamRegistry,
+                // What the Account's organization allows it to do is decided outside
+                // the Account, so IAM asks simulated Organizations about it.
+                scpResolver: this.scpResolver,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-service-factory.d.ts

@@ -22,6 +22,7 @@ import type { SimScheduler } from "../../scheduler/index.js";
 import type { SimElbV2 } from "../../elbv2/index.js";
 import type { SimIam } from "../../iam/index.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import { SimOrganizations } from "../../organizations/index.js";
 import type { SimFirehose } from "../../firehose/index.js";
 import type { SimGlue } from "../../glue/index.js";
 import type { SimKinesis } from "../../kinesis/index.js";
@@ -77,6 +78,14 @@ export declare class SimAwsServiceFactory {
      * instance so cross-account services can resolve Account-owned IAM state.
      */
     readonly iamRegistry: SimIamRegistry;
+    /**
+     * Simulated AWS Organizations for this simulation.
+     *
+     * An organization spans Accounts, so one belongs to the simulation rather
+     * than to any scope in it. Sim IAM reads the service control policies it
+     * holds when it decides a request.
+     */
+    readonly organizations: SimOrganizations;
     /**
      * Shared request authentication collaborators for this simulation.
      * @internal

package/dist/service/aws/factory/sim-aws-service-factory.js

@@ -1,5 +1,6 @@
 import { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
+import { SimOrganizations } from "../../organizations/index.js";
 import { SimLambdaUrlRegistry } from "../../lambda/registry/sim-lambda-url-registry.js";
 import { SimAwsAccountRegionServiceBuilder } from "./sim-aws-account-region-service-builder.js";
 import { SimAwsRegisteredServiceBuilder } from "./sim-aws-registered-service-builder.js";
@@ -40,6 +41,14 @@ export class SimAwsServiceFactory {
      * instance so cross-account services can resolve Account-owned IAM state.
      */
     iamRegistry = new SimIamRegistry();
+    /**
+     * Simulated AWS Organizations for this simulation.
+     *
+     * An organization spans Accounts, so one belongs to the simulation rather
+     * than to any scope in it. Sim IAM reads the service control policies it
+     * holds when it decides a request.
+     */
+    organizations = new SimOrganizations();
     /**
      * Shared request authentication collaborators for this simulation.
      * @internal
@@ -94,6 +103,7 @@ export class SimAwsServiceFactory {
             shadowableServiceHosts: this.registries.shadowableServiceHosts,
             iamRegistry: this.iamRegistry,
             accessKeyRegistry: this.requestAuth.accessKeyRegistry,
+            scpResolver: this.organizations,
         });
         this.accountRegionServices = new SimAwsAccountRegionServiceBuilder({
             simAws: properties.simAws,

package/dist/service/aws/sim-aws.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsAccountRegionContainer } from "./sim-aws-account-region-scop
 import { SimAwsServiceFactory } from "./factory/sim-aws-service-factory.js";
 import { SimAwsServiceAccessors } from "./sim-aws-service-accessors.js";
 import type { SimIamRegistry } from "../iam/registry/sim-iam-registry.js";
+import type { SimOrganizations } from "../organizations/index.js";
 import type { SimAwsPrincipal } from "./caller/sim-aws-caller.js";
 import type { SimClockControl } from "../../util/clock/sim-clock-control.js";
 import type { SimAwsProperties, SimAwsRequestCallerOptions } from "./sim-aws-properties.js";
@@ -36,6 +37,23 @@ export declare class SimAws extends SimAwsServiceAccessors {
     private readonly timekeeping;
     private readonly requestAuthentication;
     constructor(properties?: SimAwsProperties);
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations(): SimOrganizations;
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/aws/sim-aws.js

@@ -55,6 +55,25 @@ export class SimAws extends SimAwsServiceAccessors {
             clock: background,
         });
     }
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations() {
+        return this.serviceFactory.organizations;
+    }
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export declare function organizationsValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.js

@@ -0,0 +1,23 @@
+import { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import { SimOrganizationalUnitCfn, SimOrganizationCfn, SimOrganizationsAccountCfn, SimOrganizationsPolicyCfn, } from "./sim-organizations-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export function organizationsValueAdapter(properties) {
+    const { simResource } = properties;
+    if (simResource instanceof SimCfnOrganization) {
+        return new SimOrganizationCfn(simResource);
+    }
+    if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+        return new SimOrganizationalUnitCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsAccount) {
+        return new SimOrganizationsAccountCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsPolicy) {
+        return new SimOrganizationsPolicyCfn(simResource);
+    }
+    return undefined;
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn.d.ts

@@ -0,0 +1,66 @@
+import type { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import type { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * CloudFormation-facing values for a simulated organization.
+ */
+export declare class SimOrganizationCfn implements SimCfnResourceValueAdapter {
+    private readonly organization;
+    constructor(organization: SimCfnOrganization);
+    /**
+     * AWS::Organizations::Organization Ref returns the organization id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists, less the management
+     * account email, which a simulation has no address for.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated organizational unit.
+ */
+export declare class SimOrganizationalUnitCfn implements SimCfnResourceValueAdapter {
+    private readonly unit;
+    constructor(unit: SimOrganizationsOrganizationalUnit);
+    /**
+     * AWS::Organizations::OrganizationalUnit Ref returns the unit id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and Name, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for an Account a template put in the
+ * organization.
+ */
+export declare class SimOrganizationsAccountCfn implements SimCfnResourceValueAdapter {
+    private readonly account;
+    constructor(account: SimCfnOrganizationsAccount);
+    /**
+     * AWS::Organizations::Account Ref returns the Account id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated service control policy.
+ */
+export declare class SimOrganizationsPolicyCfn implements SimCfnResourceValueAdapter {
+    private readonly policy;
+    constructor(policy: SimCfnOrganizationsPolicy);
+    /**
+     * AWS::Organizations::Policy Ref returns the policy id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and AwsManaged, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn.js

@@ -0,0 +1,136 @@
+/**
+ * Refuse an attribute the AWS Resource reference does not list.
+ */
+function unknownAttribute(resourceType, attributeName) {
+    throw new Error(`AWS::Organizations::${resourceType} has no attribute ${attributeName}`);
+}
+/**
+ * CloudFormation-facing values for a simulated organization.
+ */
+export class SimOrganizationCfn {
+    organization;
+    constructor(organization) {
+        this.organization = organization;
+    }
+    /**
+     * AWS::Organizations::Organization Ref returns the organization id.
+     */
+    refValue() {
+        return this.organization.id;
+    }
+    /**
+     * The attributes the AWS Resource reference lists, less the management
+     * account email, which a simulation has no address for.
+     */
+    attributeValue(attributeName) {
+        const { organization } = this;
+        const values = new Map([
+            ["Id", organization.id],
+            [
+                "Arn",
+                `arn:aws:organizations::${organization.managementAccountId}:organization/${organization.id}`,
+            ],
+            ["RootId", organization.rootId],
+            ["ManagementAccountId", organization.managementAccountId],
+            [
+                "ManagementAccountArn",
+                `arn:aws:organizations::${organization.managementAccountId}:account/${organization.id}/${organization.managementAccountId}`,
+            ],
+        ]);
+        return (values.get(attributeName) ??
+            unknownAttribute("Organization", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for a simulated organizational unit.
+ */
+export class SimOrganizationalUnitCfn {
+    unit;
+    constructor(unit) {
+        this.unit = unit;
+    }
+    /**
+     * AWS::Organizations::OrganizationalUnit Ref returns the unit id.
+     */
+    refValue() {
+        return this.unit.id;
+    }
+    /**
+     * Id, Arn and Name, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { unit } = this;
+        const values = new Map([
+            ["Id", unit.id],
+            ["Arn", `arn:aws:organizations::organizational-unit/${unit.id}`],
+            ["Name", unit.name],
+        ]);
+        return (values.get(attributeName) ??
+            unknownAttribute("OrganizationalUnit", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for an Account a template put in the
+ * organization.
+ */
+export class SimOrganizationsAccountCfn {
+    account;
+    constructor(account) {
+        this.account = account;
+    }
+    /**
+     * AWS::Organizations::Account Ref returns the Account id.
+     */
+    refValue() {
+        return this.account.accountId;
+    }
+    /**
+     * The attributes the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { account } = this;
+        const values = new Map([
+            ["AccountId", account.accountId],
+            [
+                "Arn",
+                `arn:aws:organizations::${account.accountId}:account/${account.accountId}`,
+            ],
+            ["Email", account.email],
+            ["AccountName", account.accountName],
+            ["JoinedMethod", "CREATED"],
+            ["JoinedTimestamp", account.joinedTimestamp.toISOString()],
+            ["Status", "ACTIVE"],
+        ]);
+        return (values.get(attributeName) ?? unknownAttribute("Account", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for a simulated service control policy.
+ */
+export class SimOrganizationsPolicyCfn {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    /**
+     * AWS::Organizations::Policy Ref returns the policy id.
+     */
+    refValue() {
+        return this.policy.id;
+    }
+    /**
+     * Id, Arn and AwsManaged, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { policy } = this;
+        const values = new Map([
+            ["Id", policy.id],
+            [
+                "Arn",
+                `arn:aws:organizations::policy/service_control_policy/${policy.id}`,
+            ],
+            ["AwsManaged", false],
+        ]);
+        return (values.get(attributeName) ?? unknownAttribute("Policy", attributeName));
+    }
+}

package/dist/service/cloudformation/resource/cfn/sim-cfn-service-value-adapters.js

@@ -18,6 +18,7 @@ import { iamValueAdapter } from "./iam/sim-iam-cfn-value-adapter.js";
 import { kinesisValueAdapter } from "./kinesis/sim-kinesis-cfn-value-adapter.js";
 import { kmsValueAdapter } from "./kms/sim-kms-cfn-value-adapter.js";
 import { lambdaValueAdapter } from "./lambda/sim-lambda-cfn-value-adapter.js";
+import { organizationsValueAdapter } from "./organizations/sim-organizations-cfn-value-adapter.js";
 import { personalizeValueAdapter } from "./personalize/sim-personalize-cfn-value-adapter.js";
 import { route53ValueAdapter } from "./route53/sim-route53-cfn-value-adapter.js";
 import { s3ValueAdapter } from "./s3/sim-s3-cfn-value-adapter.js";
@@ -60,6 +61,7 @@ export const simCfnServiceValueAdapters = [
     kinesisValueAdapter,
     kmsValueAdapter,
     lambdaValueAdapter,
+    organizationsValueAdapter,
     personalizeValueAdapter,
     route53ValueAdapter,
     s3ValueAdapter,

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-factories.js

@@ -1,4 +1,5 @@
 import { SimCfnCfnResourceFactory } from "../../factory/sim-cfn-cfn-resource-factory.js";
+import { SimOrganizationsCfnResourceFactory } from "../../../../organizations/cfn/sim-organizations-cfn-resource-factory.js";
 /**
  * Certificates arrive under two service names. `AWS::CertificateManager::*` is
  * the real one, and `AWS::ACM::*` is the shorthand some templates use, so both
@@ -34,6 +35,12 @@ export const simCfnServiceResourceFactories = new Map([
         "CloudFormation",
         () => new SimCfnCfnResourceFactory(),
     ],
+    // An organization spans Accounts, so this factory reads the one on the
+    // creation context rather than the Account and Region scope it deploys into.
+    [
+        "Organizations",
+        () => new SimOrganizationsCfnResourceFactory(),
+    ],
     [
         "CloudFront",
         (scopedAws) => scopedAws.cloudFront().cfnResourceFactory(),

package/dist/service/cloudfront/command/create-distribution/create-distribution-authorizer.js

@@ -28,6 +28,7 @@ export class CreateDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateDistributionAuthorizer.action,
                 resource: CreateDistributionAuthorizer.resource,
             });

package/dist/service/cloudfront/command/create-function/create-function-authorizer.js

@@ -26,6 +26,7 @@ export class CreateFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateFunctionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/delete-distribution/delete-distribution-authorizer.js

@@ -31,6 +31,7 @@ export class DeleteDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/delete-function/delete-function-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteFunctionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/get-distribution/get-distribution-authorizer.js

@@ -27,6 +27,7 @@ export class GetDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/update-distribution/update-distribution-authorizer.js

@@ -27,6 +27,7 @@ export class UpdateDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js

@@ -18,6 +18,7 @@ export function authorizeEdgeAssociation(iam, functionArn, caller) {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource: functionArn,
             });

package/dist/service/cloudfront/key-value-store/sim-cf-key-value-store-access.js

@@ -25,6 +25,7 @@ export class SimCfKeyValueStoreAccess {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/cloudwatch/command/authorize/sim-cloudwatch-decide.js

@@ -21,6 +21,7 @@ export function decideSimCloudWatchRequest(iam, request) {
     if (decision.isDenied) {
         throw new SimIamAccessDenied({
             principal: decision.caller.principal,
+            reason: decision.denialReason,
             action,
             resource,
         });

package/dist/service/cognito/command/authorize/sim-cognito-authorizer.js

@@ -45,6 +45,7 @@ export class SimCognitoAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -56,6 +56,7 @@ export class SimDynamoDbAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -39,6 +39,7 @@ export class SimFirehoseAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/glue/command/authorize/sim-glue-authorize-resources.js

@@ -14,6 +14,7 @@ export function authorizeSimGlueResources(properties) {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });