@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-creator.js

@@ -18,7 +18,7 @@ export class SimCfnEventBusCreator {
     /**
      * Create an event bus from an AWS::Events::EventBus Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const busProperties = new SimCfnEventBusProperties({
             resource,
             properties,
@@ -27,9 +27,7 @@ export class SimCfnEventBusCreator {
         const name = busProperties.name();
         const description = busProperties.description();
         return await simCfnEventBridgeResourceCreation(eventBusResourceType, resource.logicalId, async () => {
-            await this.eventBridge.createEventBus({
-                input: { Name: name, Description: description },
-            });
+            await this.eventBridge.createEventBus({ input: { Name: name, Description: description } }, options);
             const bus = this.eventBridge.findEventBus(name);
             assertDefined(bus, `sim EventBridge bus ${name} after CloudFormation creation`);
             return bus;

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEventRule } from "../../rule/sim-event-rule.js";
 import type { SimEventBridge } from "../../sim-event-bridge.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnEventRuleCreatorProperties {
     readonly eventBridge: SimEventBridge;
 }
@@ -23,7 +24,7 @@ export declare class SimCfnEventRuleCreator {
     /**
      * Create a rule, and its targets, from an AWS::Events::Rule Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimEventRule>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimEventRule>;
     /**
      * Add everything the rule's own `Targets` list declares.
      */

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.js

@@ -22,7 +22,7 @@ export class SimCfnEventRuleCreator {
     /**
      * Create a rule, and its targets, from an AWS::Events::Rule Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const ruleProperties = new SimCfnEventRuleProperties({
             resource,
             properties,
@@ -41,8 +41,8 @@ export class SimCfnEventRuleCreator {
                     State: ruleProperties.state(),
                     Description: ruleProperties.description(),
                 },
-            });
-            await this.putTargets(name, busName, targets);
+            }, options);
+            await this.putTargets(name, busName, targets, options);
             const rule = this.eventBridge.findRule(name, busName);
             assertDefined(rule, `sim EventBridge rule ${name} after CloudFormation creation`);
             return rule;
@@ -51,7 +51,7 @@ export class SimCfnEventRuleCreator {
     /**
      * Add everything the rule's own `Targets` list declares.
      */
-    async putTargets(ruleName, busName, targets) {
+    async putTargets(ruleName, busName, targets, options) {
         if (targets.length === 0) {
             return;
         }
@@ -65,6 +65,6 @@ export class SimCfnEventRuleCreator {
                     Input: target.Input,
                 })),
             },
-        });
+        }, options);
     }
 }

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-deleter.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEventBridge } from "../sim-event-bridge.js";
 interface SimCfnEventBridgeResourceDeleterProperties {
@@ -18,7 +19,7 @@ export declare class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete one simulated EventBridge Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     /**
      * Delete the bus a Resource created, and the rules that hang off it.
      */

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-deleter.js

@@ -16,14 +16,14 @@ export class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete one simulated EventBridge Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "EventBus": {
-                await this.deleteBus(resource, properties);
+                await this.deleteBus(resource, properties, options);
                 return;
             }
             case "Rule": {
-                await this.deleteRule(resource, properties);
+                await this.deleteRule(resource, properties, options);
                 return;
             }
             default: {
@@ -34,17 +34,17 @@ export class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete the bus a Resource created, and the rules that hang off it.
      */
-    async deleteBus(resource, properties) {
+    async deleteBus(resource, properties, options) {
         const name = new SimCfnEventBusProperties({
             resource,
             properties,
         }).name();
-        await this.eventBridge.deleteEventBus({ input: { Name: name } });
+        await this.eventBridge.deleteEventBus({ input: { Name: name } }, options);
     }
     /**
      * Delete the rule a Resource created, and its targets with it.
      */
-    async deleteRule(resource, properties) {
+    async deleteRule(resource, properties, options) {
         const ruleProperties = new SimCfnEventRuleProperties({
             resource,
             properties,
@@ -54,6 +54,6 @@ export class SimCfnEventBridgeResourceDeleter {
                 Name: ruleProperties.name(),
                 EventBusName: ruleProperties.busName(),
             },
-        });
+        }, options);
     }
 }

package/dist/service/eventbridge/cfn/sim-event-bridge-cfn-resource-factory.js

@@ -1,3 +1,4 @@
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnEventBusCreator } from "./bus/sim-cfn-event-bus-creator.js";
 import { SimCfnEventRuleCreator } from "./rule/sim-cfn-event-rule-creator.js";
 import { SimCfnEventBridgeResourceDeleter } from "./sim-cfn-event-bridge-resource-deleter.js";
@@ -28,12 +29,13 @@ export class SimEventBridgeCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "EventBus": {
-                return await this.busCreator.create(resource, properties);
+                return await this.busCreator.create(resource, properties, options);
             }
             case "Rule": {
-                return await this.ruleCreator.create(resource, properties);
+                return await this.ruleCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim EventBridge CloudFormation Resource ${resourceTypeName}`);
@@ -45,6 +47,6 @@ export class SimEventBridgeCfnResourceFactory {
      * Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-function.js

@@ -1,6 +1,7 @@
 import { SimLambdaServiceInvokeAuthorizer } from "../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryDocument, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A Lambda function a simulated rule is sending an event to, in the Account
  * and Region the target ARN names.
@@ -38,7 +39,7 @@ export class SimEventBridgeDeliveryFunction {
                     "or alias.");
         }
         const decision = new SimLambdaServiceInvokeAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             resource: target.resource,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-queue.js

@@ -1,6 +1,7 @@
 import { SimSqsServiceSendAuthorizer } from "../../sqs/command/authorize/sim-sqs-service-send-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryJson, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A queue a simulated rule is sending an event to, in the Account and Region
  * the target ARN names.
@@ -25,7 +26,7 @@ export class SimEventBridgeDeliveryQueue {
             throw new SimEventBridgeTargetNotFound(`${targetArn.value} is not a simulated SQS queue.`);
         }
         const decision = new SimSqsServiceSendAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             queue,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-task.js

@@ -24,7 +24,10 @@ export class SimEventBridgeDeliveryTask {
         const ecs = this.taskTarget(request);
         const role = eventBridgeTargetRole(ecs.roleArn);
         const roleScope = this.simAws.accountRegionScope(role.accountId, arn.regionName);
-        const caller = await assumeEventBridgeTargetRole(role, roleScope.iam());
+        const caller = await assumeEventBridgeTargetRole(role, roleScope, {
+            arn: request.ruleArn,
+            accountId: request.ruleOwnerAccountId,
+        });
         await new SimEcsTargetRun({
             scope: this.simAws.accountRegionScope(arn.accountId, arn.regionName),
         }).run({ cluster: arn.value, task: ecs.task, caller });

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-topic.js

@@ -1,6 +1,7 @@
 import { SimSnsServicePublishAuthorizer } from "../../sns/command/authorize/sim-sns-service-publish-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryJson, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A topic a simulated rule is sending an event to, in the Account and Region
  * the target ARN names.
@@ -26,7 +27,7 @@ export class SimEventBridgeDeliveryTopic {
             throw new SimEventBridgeTargetNotFound(`${targetArn.value} is not a simulated SNS topic.`);
         }
         const decision = new SimSnsServicePublishAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             topic,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
-import type { SimIam } from "../../iam/sim-iam.js";
-import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role.js";
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
+import type { SimServiceRoleSource } from "../../sts/service-role/sim-service-role-source.js";
 export type SimEventBridgeTargetRole = SimServiceRoleTarget;
 /**
  * Read the Account and name out of a target's role ARN.
@@ -14,5 +15,9 @@ export declare function eventBridgeTargetRole(roleArn: string): SimServiceRoleTa
  * policy, but there is no resource policy on a task definition for a rule to be
  * admitted by, so running a task is a call the rule makes as a role of the
  * account instead. Real EventBridge requires the role for that reason.
+ *
+ * The rule is the `aws:SourceArn` AWS documents for the trust policy condition
+ * it recommends against the confused deputy problem. It is the same rule ARN a
+ * queue or topic policy is conditioned on for the other target types.
  */
-export declare function assumeEventBridgeTargetRole(target: SimEventBridgeTargetRole, iam: SimIam): Promise<SimAwsCaller>;
+export declare function assumeEventBridgeTargetRole(target: SimEventBridgeTargetRole, scope: SimAwsAccountRegionContainer, source: SimServiceRoleSource): Promise<SimAwsCaller>;

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.js

@@ -1,4 +1,5 @@
-import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { assumeSimServiceRole, } from "../../sts/service-role/sim-service-role.js";
+import { simServiceRoleTarget, } from "../../sts/service-role/sim-service-role-target.js";
 import { SimEventBridgeDeliveryNotPermitted } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeServicePrincipal } from "./sim-event-bridge-delivery.js";
 /**
@@ -29,13 +30,18 @@ const refusals = {
  * policy, but there is no resource policy on a task definition for a rule to be
  * admitted by, so running a task is a call the rule makes as a role of the
  * account instead. Real EventBridge requires the role for that reason.
+ *
+ * The rule is the `aws:SourceArn` AWS documents for the trust policy condition
+ * it recommends against the confused deputy problem. It is the same rule ARN a
+ * queue or topic policy is conditioned on for the other target types.
  */
-export async function assumeEventBridgeTargetRole(target, iam) {
+export async function assumeEventBridgeTargetRole(target, scope, source) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simEventBridgeServicePrincipal,
         sessionName,
-        iam,
+        scope,
+        source,
         refusals,
     });
 }

package/dist/service/eventbridge/sim-event-bridge.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimEventBusStore } from "./bus/sim-event-bus-store.js";
 import type * as simEventBridgeCommands from "./command/sim-event-bridge-command.types.js";
 import type { SimEventBridgeRequestOptions } from "./command/sim-event-bridge-request-options.js";

package/dist/service/eventbridge/sim-event-bridge.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimEventBus } from "./bus/sim-event-bus.js";
 import { SimEventBusStore } from "./bus/sim-event-bus-store.js";
 import { SimEventBridgeCommands } from "./command/sim-event-bridge-commands.js";
@@ -34,7 +34,8 @@ export class SimEventBridge extends SimEventBridgeInspection {
     });
     constructor(properties = {}) {
         super();
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.buses = new SimEventBusStore(SimEventBus.default({ accountRegionScope, createdAt: background.now() }));
         this.commands = new SimEventBridgeCommands({

package/dist/service/firehose/cfn/delivery-stream/sim-cfn-firehose-delivery-stream-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimFirehose } from "../../sim-firehose.js";
 import type { SimFirehoseDeliveryStream } from "../../stream/sim-firehose-delivery-stream.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnFirehoseDeliveryStreamCreatorProperties {
     readonly firehose: SimFirehose;
 }
@@ -27,6 +28,6 @@ export declare class SimCfnFirehoseDeliveryStreamCreator {
      * Create a delivery stream from an AWS::KinesisFirehose::DeliveryStream
      * Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimFirehoseDeliveryStream>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimFirehoseDeliveryStream>;
 }
 export {};

package/dist/service/firehose/cfn/delivery-stream/sim-cfn-firehose-delivery-stream-creator.js

@@ -26,14 +26,14 @@ export class SimCfnFirehoseDeliveryStreamCreator {
      * Create a delivery stream from an AWS::KinesisFirehose::DeliveryStream
      * Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         return await simCfnFirehoseResourceCreation(firehoseDeliveryStreamResourceType, resource.logicalId, async () => {
             const streamProperties = new SimCfnFirehoseDeliveryStreamProperties({
                 resource,
                 properties,
             });
             const input = streamProperties.createInput();
-            await this.firehose.createDeliveryStream({ input });
+            await this.firehose.createDeliveryStream({ input }, options);
             const deliveryStream = this.firehose.findDeliveryStream(streamProperties.name());
             assertDefined(deliveryStream, `sim Firehose delivery stream ${streamProperties.name()} after ` +
                 `CloudFormation creation`);

package/dist/service/firehose/cfn/sim-cfn-firehose-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimFirehose } from "../sim-firehose.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnFirehoseResourceDeleterProperties {
     readonly firehose: SimFirehose;
 }
@@ -13,6 +14,6 @@ export declare class SimCfnFirehoseResourceDeleter {
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/firehose/cfn/sim-cfn-firehose-resource-deleter.js

@@ -12,14 +12,12 @@ export class SimCfnFirehoseResourceDeleter {
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== firehoseDeliveryStreamResourceTypeName) {
             throw new Error(`Unsupported sim Firehose CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const deliveryStream = resource.simResource;
         assertDefined(deliveryStream, `sim Firehose delivery stream for CloudFormation Resource ${resource.logicalId}`);
-        await this.firehose.deleteDeliveryStream({
-            input: { DeliveryStreamName: deliveryStream.name },
-        });
+        await this.firehose.deleteDeliveryStream({ input: { DeliveryStreamName: deliveryStream.name } }, options);
     }
 }

package/dist/service/firehose/cfn/sim-firehose-cfn-resource-factory.d.ts

@@ -23,6 +23,6 @@ export declare class SimFirehoseCfnResourceFactory implements SimCfnServiceResou
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/firehose/cfn/sim-firehose-cfn-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnFirehoseDeliveryStreamCreator } from "./delivery-stream/sim-cfn-firehose-delivery-stream-creator.js";
 import { SimCfnFirehoseResourceDeleter } from "./sim-cfn-firehose-resource-deleter.js";
 import { firehoseDeliveryStreamResourceTypeName } from "./sim-cfn-firehose-resource-types.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Firehose resources.
  */
@@ -25,13 +26,13 @@ export class SimFirehoseCfnResourceFactory {
         if (resourceTypeName !== firehoseDeliveryStreamResourceTypeName) {
             throw new Error(`Unsupported sim Firehose CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.deliveryStreamCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.deliveryStreamCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -39,6 +39,7 @@ export class SimFirehoseAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/firehose/sim-firehose.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simFirehoseCommands from "./command/sim-firehose-command.types.js";
 import type { SimFirehoseRequestOptions } from "./command/sim-firehose-request-options.js";
 import { SimFirehoseCfnResourceFactory } from "./cfn/sim-firehose-cfn-resource-factory.js";

package/dist/service/firehose/sim-firehose.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimFirehoseCommands } from "./command/sim-firehose-commands.js";
 import { SimFirehoseCfnResourceFactory } from "./cfn/sim-firehose-cfn-resource-factory.js";
 import { SimFirehoseFailures } from "./failure/sim-firehose-failures.js";
@@ -40,7 +40,8 @@ export class SimFirehose {
         firehose: this,
     });
     constructor(properties) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), kinesis = new SimFirehoseNoRecordSource(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), kinesis = new SimFirehoseNoRecordSource(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimFirehoseCommands({
             deliveryStreams: this.deliveryStreams,

package/dist/service/glue/command/authorize/sim-glue-authorize-resources.js

@@ -14,6 +14,7 @@ export function authorizeSimGlueResources(properties) {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/glue/sim-glue.d.ts

@@ -2,7 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simGlueCommands from "./command/database/database.command.js";
 import type * as simGlueTableCommands from "./command/table/table.command.js";
 import type * as simGluePartitionCommands from "./command/partition/partition.command.js";

package/dist/service/glue/sim-glue.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimGlueAuthorizer } from "./command/authorize/sim-glue-authorizer.js";
 import { SimGlueDatabaseCommands } from "./command/database/sim-glue-database-commands.js";
 import { SimGlueTableCommands } from "./command/table/sim-glue-table-commands.js";
@@ -36,7 +36,8 @@ export class SimGlue {
     #sdkRouter = new SimGlueSdkCommandRouter(this);
     #cfnFactory;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const authorizer = new SimGlueAuthorizer({ iam, accountRegionScope });
         this.#databases = new SimGlueDatabaseStore({ accountRegionScope });
         this.#tables = new SimGlueTableStore({ accountRegionScope });

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.d.ts

@@ -0,0 +1,45 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+import type { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+interface SimIamPolicyEvaluationProperties {
+    readonly policies: readonly SimIamAuthZPolicySource[];
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export declare class SimIamPolicyEvaluation {
+    private readonly explicitDenyStatementRecords;
+    private readonly allows;
+    constructor(properties: SimIamPolicyEvaluationProperties);
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements(): SimIamAllowStatements;
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * Record the matching statements of one policy.
+     */
+    private evaluate;
+}
+export {};

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.js

@@ -0,0 +1,59 @@
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export class SimIamPolicyEvaluation {
+    explicitDenyStatementRecords = [];
+    allows = new SimIamAllowStatements();
+    constructor(properties) {
+        for (const policy of properties.policies) {
+            this.evaluate(policy, properties);
+        }
+    }
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny() {
+        return this.explicitDenyStatementRecords.length > 0;
+    }
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements() {
+        return this.explicitDenyStatementRecords;
+    }
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements() {
+        return this.allows;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        return this.allows.sides;
+    }
+    /**
+     * Record the matching statements of one policy.
+     */
+    evaluate(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        for (const statement of parsedPolicy.statements) {
+            const principal = properties.statementMatcher.matches(policy, statement);
+            if (!principal.matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.explicitDenyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allows.record(policy, statement.source, principal);
+        }
+    }
+}