@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.d.ts

@@ -0,0 +1,53 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+/**
+ * One service control policy applying to a simulated Account.
+ *
+ * The name travels with the document so a denial can say which policy produced
+ * it, the way an AWS denial names the policy in the console.
+ */
+export interface SimIamServiceControlPolicy {
+    readonly document: SimIamPolicyDocument;
+    readonly policyName?: string | undefined;
+}
+/**
+ * The policies attached at one level of the organization above an Account.
+ *
+ * AWS requires an Allow at every level between the root and the Account, so
+ * which level a policy came from decides the request rather than decorating
+ * it. The name is what a denial calls the level.
+ */
+export interface SimIamServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly policies: readonly SimIamServiceControlPolicy[];
+}
+/**
+ * The service control policies in force for one Account.
+ *
+ * Whether any apply is a separate fact from how many levels there are. An
+ * Account whose every policy has been detached is still inside the
+ * organization, and nothing allowing an action there denies it. An Account
+ * outside every organization is unrestricted. Both can hold no policy, so the
+ * levels alone cannot tell them apart.
+ */
+export interface SimIamServiceControlPolicySet {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamServiceControlPolicyLevel[];
+}
+/**
+ * Where sim IAM asks what an Account's organization allows it to do.
+ *
+ * IAM belongs to one Account and an organization spans several, so the
+ * organization is reached through this interface instead of being held by IAM
+ * itself. A standalone SimIam has no organization around it and leaves the
+ * resolver out, which is the same as an Account outside any organization.
+ */
+export interface SimIamServiceControlPolicyResolver {
+    /**
+     * The service control policies in force for an Account.
+     *
+     * A set that does not apply leaves the Account's identity and resource
+     * policies to decide the request on their own.
+     */
+    serviceControlPolicySetFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -10,6 +10,7 @@ import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAccountAuthZProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: Map<SimArn, SimIamManagedPolicy>;
@@ -24,6 +25,13 @@ interface SimIamAccountAuthZProperties {
      * standalone SimIam has no simulation around it and so no resolver.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account.
+     *
+     * A simulation with an organization in it supplies this. A standalone SimIam
+     * has none, and its Accounts sit outside any organization.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -39,6 +39,7 @@ export class SimIamAccountAuthZ {
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
             iamResolver: this.properties.iamResolver,
+            scpResolver: this.properties.scpResolver,
         });
     }
 }

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -25,6 +25,7 @@ export class SimIamActionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -10,6 +10,7 @@ import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAuthorizerProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
@@ -17,6 +18,7 @@ interface SimIamAuthorizerProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Facade for simulated IAM authorization decisions.

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -18,6 +18,7 @@ export class SimIamAuthorizer {
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/iam/authorize/sim-iam-decision-value.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export declare const SimIamPolicyDecisionValue: {
+    readonly ExplicitDeny: "ExplicitDeny";
+    readonly Allow: "Allow";
+    readonly ImplicitDeny: "ImplicitDeny";
+};
+export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];

package/dist/service/iam/authorize/sim-iam-decision-value.js

@@ -0,0 +1,12 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export const SimIamPolicyDecisionValue = {
+    ExplicitDeny: "ExplicitDeny",
+    Allow: "Allow",
+    ImplicitDeny: "ImplicitDeny",
+};

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -2,36 +2,37 @@ import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js"
 import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
-export declare const SimIamPolicyDecisionValue: {
-    readonly ExplicitDeny: "ExplicitDeny";
-    readonly Allow: "Allow";
-    readonly ImplicitDeny: "ImplicitDeny";
-};
-export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export declare class SimIamPolicyDecision {
     private readonly request;
-    private readonly policyDocumentParser;
-    private readonly statementMatcher;
-    private readonly explicitDenyStatementRecords;
-    private readonly allows;
+    private readonly policies;
+    private readonly scpGate;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -70,6 +71,24 @@ export declare class SimIamPolicyDecision {
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy(): SimIamScpGate;
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason(): string | undefined;
     /**
      * Matching Allow statements, from both policy sides.
      *
@@ -90,6 +109,4 @@ export declare class SimIamPolicyDecision {
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
-    private evaluate;
-    private evaluatePolicy;
 }

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,40 +1,50 @@
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
-import { SimIamAllowStatements } from "./allow/sim-iam-allow-statements.js";
-export const SimIamPolicyDecisionValue = {
-    ExplicitDeny: "ExplicitDeny",
-    Allow: "Allow",
-    ImplicitDeny: "ImplicitDeny",
-};
+import { SimIamPolicyEvaluation } from "./allow/sim-iam-policy-evaluation.js";
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export class SimIamPolicyDecision {
     request;
-    policyDocumentParser;
-    statementMatcher;
-    explicitDenyStatementRecords = [];
-    allows = new SimIamAllowStatements();
+    policies;
+    scpGate;
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
+        const statementMatcher = new SimIamPolicyStatementMatcher(request);
         this.request = request;
-        this.policyDocumentParser = policyDocumentParser;
-        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
-        this.evaluate();
+        this.policies = new SimIamPolicyEvaluation({
+            policies: [...request.identityPolicies, ...request.resourcePolicies],
+            policyDocumentParser,
+            statementMatcher,
+        });
+        this.scpGate = new SimIamScpGate({
+            serviceControlPolicies: request.serviceControlPolicies,
+            policyDocumentParser,
+            statementMatcher,
+        });
     }
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -49,13 +59,15 @@ export class SimIamPolicyDecision {
      * Final IAM decision value.
      */
     get value() {
-        if (this.explicitDenyStatementRecords.length > 0) {
+        if (this.policies.isExplicitDeny) {
             return SimIamPolicyDecisionValue.ExplicitDeny;
         }
-        if (this.request.allowRequirement.isSatisfiedBy(this.allows.sides)) {
-            return SimIamPolicyDecisionValue.Allow;
+        if (this.scpGate.value !== undefined) {
+            return this.scpGate.value;
         }
-        return SimIamPolicyDecisionValue.ImplicitDeny;
+        return this.request.allowRequirement.isSatisfiedBy(this.policies.sides)
+            ? SimIamPolicyDecisionValue.Allow
+            : SimIamPolicyDecisionValue.ImplicitDeny;
     }
     /**
      * Whether the request is allowed.
@@ -87,13 +99,38 @@ export class SimIamPolicyDecision {
      * An identity-policy Allow cannot substitute for the target role's trust.
      */
     get isAllowedByTrustPolicy() {
-        return this.allows.trust.length > 0;
+        return this.policies.allowStatements.trust.length > 0;
     }
     /**
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements() {
-        return this.explicitDenyStatementRecords;
+        return this.policies.explicitDenyStatements;
+    }
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy() {
+        return this.scpGate;
+    }
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason() {
+        if (this.policies.isExplicitDeny) {
+            return undefined;
+        }
+        return this.scpGate.denialReason(this.request.action);
     }
     /**
      * Matching Allow statements, from both policy sides.
@@ -103,46 +140,24 @@ export class SimIamPolicyDecision {
      * from each side.
      */
     get allowStatements() {
-        return this.allows.all;
+        return this.policies.allowStatements.all;
     }
     /**
      * Matching Allow statements from identity-based policies.
      */
     get identityAllowStatements() {
-        return this.allows.identity;
+        return this.policies.allowStatements.identity;
     }
     /**
      * Matching Allow statements from resource-based policies.
      */
     get resourceAllowStatements() {
-        return this.allows.resource;
+        return this.policies.allowStatements.resource;
     }
     /**
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements() {
-        return this.allows.trust;
-    }
-    evaluate() {
-        for (const policy of [
-            ...this.request.identityPolicies,
-            ...this.request.resourcePolicies,
-        ]) {
-            this.evaluatePolicy(policy);
-        }
-    }
-    evaluatePolicy(policy) {
-        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
-        for (const statement of parsedPolicy.statements) {
-            const principal = this.statementMatcher.matches(policy, statement);
-            if (!principal.matched) {
-                continue;
-            }
-            if (statement.effect === "Deny") {
-                this.explicitDenyStatementRecords.push(statement.source);
-                continue;
-            }
-            this.allows.record(policy, statement.source, principal);
-        }
+        return this.policies.allowStatements.trust;
     }
 }

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.d.ts

@@ -15,6 +15,14 @@ export interface SimIamAuthorizationDecision {
     readonly caller: SimAwsResolvedCaller;
     readonly isAllowed: boolean;
     readonly isDenied: boolean;
+    /**
+     * How an AccessDenied error should explain this denial, where the action and
+     * the resource leave something out.
+     *
+     * A service control policy denial is the case this exists for. Absent for a
+     * denial an identity or resource policy accounts for on its own.
+     */
+    readonly denialReason?: string | undefined;
 }
 /**
  * IAM authorization capability consumed by other simulated AWS services.

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.js

@@ -32,6 +32,7 @@ export class SimIamAllowAllAuth {
             caller,
             isAllowed: true,
             isDenied: false,
+            denialReason: undefined,
         };
     }
 }

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -19,6 +19,14 @@ export interface SimIamAccessDeniedInput {
     readonly principal: SimAwsPrincipal;
     readonly action: string;
     readonly resource: string;
+    /**
+     * What else the message should say about why the request was denied.
+     *
+     * AWS names the source of a denial when it is something beyond the caller's
+     * own permissions, such as a service control policy. A denial the caller's
+     * identity and resource policies account for adds nothing here.
+     */
+    readonly reason?: string | undefined;
 }
 /**
  * Simulated IAM AccessDenied error.

package/dist/service/iam/error/sim-iam.error.js

@@ -27,7 +27,8 @@ export class SimIamAccessDenied extends SimIamError {
     constructor(input) {
         const iamCallerIdentifier = new SimIamCallerIdentifier();
         const callerIdentifier = iamCallerIdentifier.format(input.principal);
-        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}`, { httpStatusCode: 403 });
+        const reason = input.reason === undefined ? "" : ` ${input.reason}`;
+        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}${reason}`, { httpStatusCode: 403 });
         this.caller = input.principal;
         this.action = input.action;
         this.resource = input.resource;

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -10,6 +10,7 @@ import { SimIamSessionManager } from "./credential/session/sim-iam-session-manag
 import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimIamAccountResolver } from "./registry/sim-iam-account-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "./authorize/scp/sim-iam-scp-resolver.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
 export interface SimIamProperties {
@@ -26,6 +27,14 @@ export interface SimIamProperties {
      * simulation around it and so leaves this out.
      */
     readonly iamResolver?: SimIamAccountResolver;
+    /**
+     * Resolves the service control policies in force for this Account.
+     *
+     * Simulated Organizations supplies this when a SimAws builds IAM. A
+     * standalone SimIam has no organization around it, which is the same as an
+     * Account belonging to none.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver;
 }
 /**
  * The state and collaborators of one simulated IAM Account.

package/dist/service/iam/sim-iam-account-parts.js

@@ -48,6 +48,7 @@ export class SimIamAccountParts {
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/kinesis/command/authorize/sim-kinesis-authorizer.js

@@ -37,6 +37,7 @@ export class SimKinesisAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -45,6 +45,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource: key.arn,
             });
@@ -65,6 +66,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/lambda/command/create-function/create-function-authorizer.js

@@ -27,6 +27,7 @@ export class CreateFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/delete-function/delete-function-authorizer.js

@@ -23,6 +23,7 @@ export class DeleteFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/event-invoke-config/event-invoke-config-authorizer.js

@@ -30,6 +30,7 @@ export class EventInvokeConfigAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/function-url/function-url-authorizer.js

@@ -30,6 +30,7 @@ export class FunctionUrlAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/get-function/get-function-authorizer.js

@@ -27,6 +27,7 @@ export class GetFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetFunctionAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/invoke/invoke-authorizer.js

@@ -37,6 +37,7 @@ export class InvokeAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: InvokeAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/list-functions/list-functions-authorizer.js

@@ -32,6 +32,7 @@ export class ListFunctionsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListFunctionsAuthorizer.action,
                 resource: ListFunctionsAuthorizer.resource,
             });

package/dist/service/lambda/command/update-function-code/update-function-code-authorizer.js

@@ -28,6 +28,7 @@ export class UpdateFunctionCodeAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateFunctionCodeAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.js

@@ -29,6 +29,7 @@ export class UpdateFunctionConfigurationAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateFunctionConfigurationAuthorizer.action,
                 resource: functionArn,
             });

package/dist/service/lambda/command/version/version-authorizer.js

@@ -30,6 +30,7 @@ export class VersionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: this.action,
                 resource: functionArn,
             });

package/dist/service/logs/command/authorize/sim-logs-authorizer.js

@@ -52,6 +52,7 @@ export class SimLogsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/organizations/cfn/sim-cfn-organization-creator.d.ts

@@ -0,0 +1,19 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCfnOrganization } from "./sim-cfn-organizations-record.js";
+/**
+ * Records the organization an `AWS::Organizations::Organization` declares.
+ *
+ * A SimAws already has one organization, so this brings nothing into being.
+ * The Resource earns its place by answering `RootId`, which is what the rest
+ * of a template hangs off.
+ */
+export declare class SimCfnOrganizationCreator {
+    #private;
+    constructor(simAws: SimAws);
+    /**
+     * Record the organization a template declares.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnOrganization;
+}