@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/organizations/policy/sim-organizations-effective-policies.js

@@ -0,0 +1,58 @@
+/**
+ * Works out which service control policies an Account is actually subject to.
+ *
+ * The tree says which nodes lie above an Account and the store says what hangs
+ * on each of them. Putting the two together is the whole of what sim IAM asks
+ * an organization, so it lives here rather than in the facade.
+ */
+export class SimOrganizationsEffectivePolicies {
+    tree;
+    scpStore;
+    managementAccountId;
+    constructor(properties) {
+        this.tree = properties.tree;
+        this.scpStore = properties.scpStore;
+    }
+    /**
+     * Name the Account AWS exempts from every service control policy.
+     */
+    setManagementAccount(accountId) {
+        this.managementAccountId = accountId;
+    }
+    /**
+     * The policies in force for an Account, level by level, root first.
+     */
+    setFor(accountId) {
+        if (accountId === this.managementAccountId) {
+            return { applies: false, levels: [] };
+        }
+        const path = this.pathFor(accountId);
+        if (path.length === 0) {
+            return { applies: false, levels: [] };
+        }
+        return { applies: true, levels: path.map((node) => this.levelAt(node)) };
+    }
+    /**
+     * The nodes filtering an Account's requests.
+     *
+     * An Account placed in the organization is filtered by the path down to it.
+     * An Account only ever named by having a policy attached to it is filtered
+     * by that policy alone, which is what attaching to an Account meant before
+     * the organization had a shape.
+     */
+    pathFor(accountId) {
+        if (this.tree.holds(accountId)) {
+            return this.tree.pathTo(accountId);
+        }
+        return this.scpStore.holds(accountId) ? [accountId] : [];
+    }
+    /**
+     * What one node contributes to an Account's decision.
+     */
+    levelAt(nodeId) {
+        return {
+            nodeName: this.tree.nameOf(nodeId),
+            policies: this.scpStore.policiesAt(nodeId),
+        };
+    }
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.d.ts

@@ -0,0 +1,61 @@
+import type { SimIamServiceControlPolicy } from "../../iam/authorize/scp/sim-iam-scp-resolver.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import type { SimOrganizationsNodeId } from "../tree/sim-organizations-node.js";
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export declare const SIM_ORGANIZATIONS_FULL_AWS_ACCESS: SimIamServiceControlPolicy;
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export declare class SimOrganizationsScpStore {
+    private readonly byNodeId;
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId: SimOrganizationsNodeId, policyId: string, document: SimIamPolicyDocument, policyName?: string): void;
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId: SimOrganizationsNodeId, policyId: string): void;
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId: SimOrganizationsNodeId): readonly SimIamServiceControlPolicy[];
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId: SimOrganizationsNodeId): boolean;
+    /**
+     * The record for a node, created on first use.
+     */
+    private nodePolicies;
+}

package/dist/service/organizations/policy/sim-organizations-scp-store.js

@@ -0,0 +1,103 @@
+/**
+ * The AWS-managed policy attached to every organization node by default.
+ *
+ * Turning service control policies on in an organization leaves every
+ * account's permissions as they were, because this policy comes with them. A
+ * simulated node gets the same treatment, so attaching one Deny statement
+ * denies that one action and leaves the rest working.
+ */
+export const SIM_ORGANIZATIONS_FULL_AWS_ACCESS = {
+    policyName: "FullAWSAccess",
+    document: {
+        Version: "2012-10-17",
+        Statement: { Effect: "Allow", Action: "*", Resource: "*" },
+    },
+};
+/**
+ * The service control policies attached to each node of an organization.
+ *
+ * A node holds FullAWSAccess along with whatever was attached to it, until a
+ * test detaches FullAWSAccess to write an allow list at that node. A node
+ * nothing was attached to still holds FullAWSAccess, so an organizational unit
+ * a test never mentions allows everything through it.
+ */
+export class SimOrganizationsScpStore {
+    byNodeId = new Map();
+    /**
+     * Attach a service control policy to a node under an id of its own.
+     *
+     * The id is what takes the policy off again. One policy attached to several
+     * nodes carries the same id at each of them, the way an AWS policy attached
+     * to several targets is one policy.
+     */
+    attach(nodeId, policyId, document, policyName) {
+        this.nodePolicies(nodeId).attached.push({
+            policyId,
+            policy: { document, policyName },
+        });
+    }
+    /**
+     * Take one service control policy off a node, leaving the rest.
+     *
+     * A node can hold policies from more than one source, so taking the wrong
+     * ones off would change what an Account may do behind the caller's back.
+     */
+    detach(nodeId, policyId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return;
+        }
+        const remaining = node.attached.filter((attached) => attached.policyId !== policyId);
+        node.attached.length = 0;
+        node.attached.push(...remaining);
+    }
+    /**
+     * Take the AWS-managed FullAWSAccess policy off a node.
+     *
+     * What remains at that node has to allow an action for a request through it
+     * to go ahead, which is how a level is turned into an allow list.
+     */
+    detachFullAwsAccess(nodeId) {
+        this.nodePolicies(nodeId).fullAwsAccess = false;
+    }
+    /**
+     * Put a node back to holding FullAWSAccess and nothing else.
+     */
+    detachAll(nodeId) {
+        this.byNodeId.delete(nodeId);
+    }
+    /**
+     * The policies in force at one node, FullAWSAccess first.
+     */
+    policiesAt(nodeId) {
+        const node = this.byNodeId.get(nodeId);
+        if (node === undefined) {
+            return [SIM_ORGANIZATIONS_FULL_AWS_ACCESS];
+        }
+        const attached = node.attached.map((entry) => entry.policy);
+        return node.fullAwsAccess
+            ? [SIM_ORGANIZATIONS_FULL_AWS_ACCESS, ...attached]
+            : attached;
+    }
+    /**
+     * Whether anything has been attached to or detached from a node.
+     */
+    holds(nodeId) {
+        return this.byNodeId.has(nodeId);
+    }
+    /**
+     * The record for a node, created on first use.
+     */
+    nodePolicies(nodeId) {
+        const existing = this.byNodeId.get(nodeId);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const created = {
+            attached: [],
+            fullAwsAccess: true,
+        };
+        this.byNodeId.set(nodeId, created);
+        return created;
+    }
+}

package/dist/service/organizations/sim-organizations-structure.d.ts

@@ -0,0 +1,94 @@
+import { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+import { SimOrganizationsScpStore } from "./policy/sim-organizations-scp-store.js";
+import { type SimOrganizationsNodeId, type SimOrganizationsOrganizationalUnit, type SimOrganizationsRoot, type SimOrganizationsTarget } from "./tree/sim-organizations-node.js";
+import { SimOrganizationsTree } from "./tree/sim-organizations-tree.js";
+/**
+ * The shape of one simulated organization: its root, the organizational units
+ * under it, and where its Accounts sit.
+ *
+ * SimOrganizations is the facade a test reaches through, and this is the half
+ * of it concerned with structure. The policies that hang on that structure are
+ * the other half.
+ */
+export declare abstract class SimOrganizationsStructure {
+    protected readonly scpStore: SimOrganizationsScpStore;
+    protected readonly tree: SimOrganizationsTree;
+    protected readonly effectivePolicies: SimOrganizationsEffectivePolicies;
+    /**
+     * The root of this organization, which every Account sits under.
+     */
+    root(): SimOrganizationsRoot;
+    /**
+     * Create an organizational unit, under the root unless a parent unit is
+     * given.
+     */
+    createOrganizationalUnit(name: string, parent?: SimOrganizationsTarget): SimOrganizationsOrganizationalUnit;
+    /**
+     * Put an Account in the organization, under an organizational unit or under
+     * the root.
+     */
+    moveAccount(accountId: string, parent?: SimOrganizationsTarget): void;
+    /**
+     * Name the Account that pays the organization's bills.
+     *
+     * AWS exempts the management account from every service control policy, and
+     * so does this. An Account named here is decided by its identity and
+     * resource policies alone, whatever is attached above it.
+     */
+    setManagementAccount(accountId: string): void;
+    /**
+     * Every Account this organization holds.
+     *
+     * A test tracking down where a denial came from reads this to see which
+     * Accounts the organization is filtering at all.
+     */
+    accountIds(): readonly string[];
+    /**
+     * Take an Account out of the organization.
+     *
+     * Nothing then filters its requests, whatever is attached above where it
+     * sat. This is how an Account leaves an organization, and it is a different
+     * thing from taking the policies off it.
+     */
+    removeAccount(accountId: string): void;
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Anything still under it moves up to its parent, so every Account keeps a
+     * path back to the root.
+     */
+    removeOrganizationalUnit(target: SimOrganizationsTarget): void;
+    /**
+     * The node a target names.
+     *
+     * An Account is named by its twelve-digit id and needs no place in the
+     * organization yet, because attaching a policy to one is what puts it there.
+     * A root or organizational unit, whether given as a handle or as the `r-` or
+     * `ou-` id a template carries, has to be this organization's own. One from
+     * another organization is refused rather than attached to and never read.
+     */
+    protected nodeIdOf(target: SimOrganizationsTarget): SimOrganizationsNodeId;
+    /**
+     * Refuse the whole set unless every target names a node this organization
+     * has.
+     *
+     * Attaching one policy to several nodes is one act, so it either reaches all
+     * of them or none. Failing partway would leave a policy attached where
+     * nothing knows to take it off.
+     */
+    requireTargets(targets: readonly SimOrganizationsTarget[]): void;
+    /**
+     * The node a target names, or nothing where this organization has no such
+     * node.
+     *
+     * Taking something off a node that has already gone is what a Stack teardown
+     * asks for when a unit came down before the policy pointing at it. There is
+     * nothing to take off, and refusing would fail a teardown over work already
+     * done.
+     */
+    protected knownNodeIdOf(target: SimOrganizationsTarget): SimOrganizationsNodeId | undefined;
+    /**
+     * The node something sits under, defaulting to the root.
+     */
+    private parentIdOf;
+}

package/dist/service/organizations/sim-organizations-structure.js

@@ -0,0 +1,140 @@
+import { simAwsAccountId } from "../aws/sim-aws-account.js";
+import { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+import { SimOrganizationsScpStore } from "./policy/sim-organizations-scp-store.js";
+import { isSimOrganizationsUnitId, } from "./tree/sim-organizations-node.js";
+import { SimOrganizationsTree } from "./tree/sim-organizations-tree.js";
+/**
+ * The shape of one simulated organization: its root, the organizational units
+ * under it, and where its Accounts sit.
+ *
+ * SimOrganizations is the facade a test reaches through, and this is the half
+ * of it concerned with structure. The policies that hang on that structure are
+ * the other half.
+ */
+export class SimOrganizationsStructure {
+    scpStore = new SimOrganizationsScpStore();
+    tree = new SimOrganizationsTree();
+    effectivePolicies = new SimOrganizationsEffectivePolicies({
+        tree: this.tree,
+        scpStore: this.scpStore,
+    });
+    /**
+     * The root of this organization, which every Account sits under.
+     */
+    root() {
+        return this.tree.root;
+    }
+    /**
+     * Create an organizational unit, under the root unless a parent unit is
+     * given.
+     */
+    createOrganizationalUnit(name, parent) {
+        return this.tree.createOrganizationalUnit(name, this.parentIdOf(parent));
+    }
+    /**
+     * Put an Account in the organization, under an organizational unit or under
+     * the root.
+     */
+    moveAccount(accountId, parent) {
+        this.tree.placeAccount(simAwsAccountId(accountId), this.parentIdOf(parent));
+    }
+    /**
+     * Name the Account that pays the organization's bills.
+     *
+     * AWS exempts the management account from every service control policy, and
+     * so does this. An Account named here is decided by its identity and
+     * resource policies alone, whatever is attached above it.
+     */
+    setManagementAccount(accountId) {
+        const account = simAwsAccountId(accountId);
+        this.effectivePolicies.setManagementAccount(account);
+        this.tree.placeAccount(account);
+    }
+    /**
+     * Every Account this organization holds.
+     *
+     * A test tracking down where a denial came from reads this to see which
+     * Accounts the organization is filtering at all.
+     */
+    accountIds() {
+        return this.tree.accountIds();
+    }
+    /**
+     * Take an Account out of the organization.
+     *
+     * Nothing then filters its requests, whatever is attached above where it
+     * sat. This is how an Account leaves an organization, and it is a different
+     * thing from taking the policies off it.
+     */
+    removeAccount(accountId) {
+        this.tree.removeAccount(simAwsAccountId(accountId));
+    }
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Anything still under it moves up to its parent, so every Account keeps a
+     * path back to the root.
+     */
+    removeOrganizationalUnit(target) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.tree.removeOrganizationalUnit(nodeId);
+        }
+    }
+    /**
+     * The node a target names.
+     *
+     * An Account is named by its twelve-digit id and needs no place in the
+     * organization yet, because attaching a policy to one is what puts it there.
+     * A root or organizational unit, whether given as a handle or as the `r-` or
+     * `ou-` id a template carries, has to be this organization's own. One from
+     * another organization is refused rather than attached to and never read.
+     */
+    nodeIdOf(target) {
+        if (typeof target !== "string") {
+            this.tree.requireNode(target.id);
+            return target.id;
+        }
+        if (!isSimOrganizationsUnitId(target)) {
+            return simAwsAccountId(target);
+        }
+        const nodeId = target;
+        this.tree.requireNode(nodeId);
+        return nodeId;
+    }
+    /**
+     * Refuse the whole set unless every target names a node this organization
+     * has.
+     *
+     * Attaching one policy to several nodes is one act, so it either reaches all
+     * of them or none. Failing partway would leave a policy attached where
+     * nothing knows to take it off.
+     */
+    requireTargets(targets) {
+        for (const target of targets) {
+            this.nodeIdOf(target);
+        }
+    }
+    /**
+     * The node a target names, or nothing where this organization has no such
+     * node.
+     *
+     * Taking something off a node that has already gone is what a Stack teardown
+     * asks for when a unit came down before the policy pointing at it. There is
+     * nothing to take off, and refusing would fail a teardown over work already
+     * done.
+     */
+    knownNodeIdOf(target) {
+        if (typeof target === "string" && !isSimOrganizationsUnitId(target)) {
+            return simAwsAccountId(target);
+        }
+        const nodeId = (typeof target === "string" ? target : target.id);
+        return this.tree.hasNode(nodeId) ? nodeId : undefined;
+    }
+    /**
+     * The node something sits under, defaulting to the root.
+     */
+    parentIdOf(parent) {
+        return parent === undefined ? undefined : this.nodeIdOf(parent);
+    }
+}

package/dist/service/organizations/sim-organizations.d.ts

@@ -0,0 +1,95 @@
+import { type SimAwsAccountId } from "../aws/sim-aws-account.js";
+import type { SimIamPolicyDocument } from "../iam/policy/sim-iam-policy.js";
+import type { SimIamServiceControlPolicy, SimIamServiceControlPolicyResolver, SimIamServiceControlPolicySet } from "../iam/authorize/scp/sim-iam-scp-resolver.js";
+import { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+import { type SimOrganizationsTarget } from "./tree/sim-organizations-node.js";
+/**
+ * Options for one attached service control policy.
+ */
+export interface SimOrganizationsAttachOptions {
+    /**
+     * What to call the policy in a denial. Defaults to `ServiceControlPolicy`.
+     */
+    readonly policyName?: string | undefined;
+    /**
+     * The id to attach the policy under, for taking it off again later.
+     *
+     * One policy attached to several nodes takes the same id at each of them.
+     * Defaults to an id of this attachment's own.
+     */
+    readonly policyId?: string | undefined;
+}
+/**
+ * Simulated AWS Organizations, holding the organization structure and the
+ * service control policies that decide what its Accounts may do.
+ *
+ * An organization spans Accounts, so one of these belongs to a SimAws rather
+ * than to an Account scope, and it is reached as `simAws.organizations()`.
+ *
+ * A service control policy filters permissions and grants none. Every level
+ * between the root and an Account has to allow an action for the Account to be
+ * allowed it, and a Deny at any level ends the request whatever else allows
+ * it. That applies to the Account root as well as to its Roles and Users, so
+ * it catches a CloudFormation deployment and an intercepted SDK call alike.
+ *
+ * The root, the organizational units and where the Accounts sit come from
+ * SimOrganizationsStructure, which this extends.
+ */
+export declare class SimOrganizations extends SimOrganizationsStructure implements SimIamServiceControlPolicyResolver {
+    /**
+     * Attach a service control policy to the root, an organizational unit, or an
+     * Account.
+     *
+     * The node also holds AWS's own FullAWSAccess policy, as it would in a real
+     * organization, so one Deny statement denies that action and leaves the rest
+     * of the node's Accounts working.
+     */
+    attachServiceControlPolicy(target: SimOrganizationsTarget, document: SimIamPolicyDocument, options?: SimOrganizationsAttachOptions): string;
+    /**
+     * Take one service control policy off a node, leaving whatever else is
+     * attached there.
+     *
+     * This is what a CloudFormation teardown uses, because a node can hold
+     * policies from more than one Stack and clearing it would take another
+     * Stack's guardrail away.
+     */
+    detachServiceControlPolicy(target: SimOrganizationsTarget, policyId: string): void;
+    /**
+     * Take AWS's FullAWSAccess policy off a node, leaving only the policies
+     * attached to it to allow anything through that level.
+     *
+     * This turns the node into an allow list. An action no policy attached there
+     * allows is denied for every Account beneath it.
+     */
+    detachFullAwsAccess(target: SimOrganizationsTarget): void;
+    /**
+     * Remove every service control policy attached to a node.
+     *
+     * Only that node is cleared. An Account sitting in an organizational unit
+     * goes on inheriting what the levels above it say, as it does in AWS, where
+     * detaching a policy from an account leaves the account where it is. Take an
+     * Account out of the organization with `removeAccount`.
+     *
+     * A node that has already gone leaves nothing to take off, so this does
+     * nothing rather than refusing. A Stack teardown reaches that case whenever
+     * a unit came down before the policy pointing at it.
+     */
+    detachServiceControlPolicies(target: SimOrganizationsTarget): void;
+    /**
+     * The service control policies in force for an Account, root level first.
+     *
+     * This flattens the levels, so it says what was evaluated without saying
+     * which level each policy came from. `serviceControlPolicySetFor` keeps that
+     * apart, and a denial needs it, because a level allowing nothing denies the
+     * Account whatever another level allows.
+     */
+    serviceControlPoliciesFor(accountId: SimAwsAccountId | string): readonly SimIamServiceControlPolicy[];
+    /**
+     * The policies in force for an Account, level by level, along with whether
+     * the Account is inside this organization at all.
+     *
+     * Sim IAM reads this rather than the flattened list, because each level has
+     * to allow an action on its own.
+     */
+    serviceControlPolicySetFor(accountId: SimAwsAccountId | string): SimIamServiceControlPolicySet;
+}

package/dist/service/organizations/sim-organizations.js

@@ -0,0 +1,99 @@
+import { simAwsAccountId, } from "../aws/sim-aws-account.js";
+import { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+import { makeSimOrganizationsPolicyId, } from "./tree/sim-organizations-node.js";
+/**
+ * Simulated AWS Organizations, holding the organization structure and the
+ * service control policies that decide what its Accounts may do.
+ *
+ * An organization spans Accounts, so one of these belongs to a SimAws rather
+ * than to an Account scope, and it is reached as `simAws.organizations()`.
+ *
+ * A service control policy filters permissions and grants none. Every level
+ * between the root and an Account has to allow an action for the Account to be
+ * allowed it, and a Deny at any level ends the request whatever else allows
+ * it. That applies to the Account root as well as to its Roles and Users, so
+ * it catches a CloudFormation deployment and an intercepted SDK call alike.
+ *
+ * The root, the organizational units and where the Accounts sit come from
+ * SimOrganizationsStructure, which this extends.
+ */
+export class SimOrganizations extends SimOrganizationsStructure {
+    /**
+     * Attach a service control policy to the root, an organizational unit, or an
+     * Account.
+     *
+     * The node also holds AWS's own FullAWSAccess policy, as it would in a real
+     * organization, so one Deny statement denies that action and leaves the rest
+     * of the node's Accounts working.
+     */
+    attachServiceControlPolicy(target, document, options = {}) {
+        const policyName = options.policyName ?? "ServiceControlPolicy";
+        const policyId = options.policyId ?? makeSimOrganizationsPolicyId();
+        this.scpStore.attach(this.nodeIdOf(target), policyId, document, policyName);
+        return policyId;
+    }
+    /**
+     * Take one service control policy off a node, leaving whatever else is
+     * attached there.
+     *
+     * This is what a CloudFormation teardown uses, because a node can hold
+     * policies from more than one Stack and clearing it would take another
+     * Stack's guardrail away.
+     */
+    detachServiceControlPolicy(target, policyId) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.scpStore.detach(nodeId, policyId);
+        }
+    }
+    /**
+     * Take AWS's FullAWSAccess policy off a node, leaving only the policies
+     * attached to it to allow anything through that level.
+     *
+     * This turns the node into an allow list. An action no policy attached there
+     * allows is denied for every Account beneath it.
+     */
+    detachFullAwsAccess(target) {
+        this.scpStore.detachFullAwsAccess(this.nodeIdOf(target));
+    }
+    /**
+     * Remove every service control policy attached to a node.
+     *
+     * Only that node is cleared. An Account sitting in an organizational unit
+     * goes on inheriting what the levels above it say, as it does in AWS, where
+     * detaching a policy from an account leaves the account where it is. Take an
+     * Account out of the organization with `removeAccount`.
+     *
+     * A node that has already gone leaves nothing to take off, so this does
+     * nothing rather than refusing. A Stack teardown reaches that case whenever
+     * a unit came down before the policy pointing at it.
+     */
+    detachServiceControlPolicies(target) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.scpStore.detachAll(nodeId);
+        }
+    }
+    /**
+     * The service control policies in force for an Account, root level first.
+     *
+     * This flattens the levels, so it says what was evaluated without saying
+     * which level each policy came from. `serviceControlPolicySetFor` keeps that
+     * apart, and a denial needs it, because a level allowing nothing denies the
+     * Account whatever another level allows.
+     */
+    serviceControlPoliciesFor(accountId) {
+        const set = this.serviceControlPolicySetFor(accountId);
+        return set.levels.flatMap((level) => level.policies);
+    }
+    /**
+     * The policies in force for an Account, level by level, along with whether
+     * the Account is inside this organization at all.
+     *
+     * Sim IAM reads this rather than the flattened list, because each level has
+     * to allow an action on its own.
+     */
+    serviceControlPolicySetFor(accountId) {
+        return this.effectivePolicies.setFor(simAwsAccountId(accountId));
+    }
+}