@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.js

@@ -0,0 +1,148 @@
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export class SimIamScpGate {
+    applies;
+    denyStatementRecords = [];
+    allowStatementRecords = [];
+    unallowedLevelNames = [];
+    constructor(properties) {
+        this.applies = properties.serviceControlPolicies.applies;
+        for (const level of properties.serviceControlPolicies.levels) {
+            this.evaluateLevel(level, properties);
+        }
+        if (this.applies && properties.serviceControlPolicies.levels.length === 0) {
+            this.unallowedLevelNames.push("the organization");
+        }
+    }
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied() {
+        return this.applies;
+    }
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny() {
+        return this.denyStatementRecords.length > 0;
+    }
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny() {
+        return (this.applies &&
+            !this.isExplicitDeny &&
+            this.unallowedLevelNames.length > 0);
+    }
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied() {
+        return this.isExplicitDeny || this.isImplicitDeny;
+    }
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value() {
+        if (this.isExplicitDeny) {
+            return SimIamPolicyDecisionValue.ExplicitDeny;
+        }
+        return this.isImplicitDeny
+            ? SimIamPolicyDecisionValue.ImplicitDeny
+            : undefined;
+    }
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements() {
+        return this.denyStatementRecords;
+    }
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements() {
+        return this.allowStatementRecords;
+    }
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels() {
+        return this.unallowedLevelNames;
+    }
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action) {
+        if (this.isExplicitDeny) {
+            return "with an explicit deny in a service control policy";
+        }
+        if (this.isImplicitDeny) {
+            return `because no service control policy allows the ${action} action`;
+        }
+        return undefined;
+    }
+    /**
+     * Record what one level of the organization said.
+     */
+    evaluateLevel(level, properties) {
+        let allowed = false;
+        for (const policy of level.sources) {
+            allowed = this.evaluatePolicy(policy, properties) || allowed;
+        }
+        if (!allowed) {
+            this.unallowedLevelNames.push(level.nodeName);
+        }
+    }
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    evaluatePolicy(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        let allowed = false;
+        for (const statement of parsedPolicy.statements) {
+            if (!properties.statementMatcher.matches(policy, statement).matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.denyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allowStatementRecords.push(statement.source);
+            allowed = true;
+        }
+        return allowed;
+    }
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.d.ts

@@ -0,0 +1,53 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+/**
+ * One service control policy applying to a simulated Account.
+ *
+ * The name travels with the document so a denial can say which policy produced
+ * it, the way an AWS denial names the policy in the console.
+ */
+export interface SimIamServiceControlPolicy {
+    readonly document: SimIamPolicyDocument;
+    readonly policyName?: string | undefined;
+}
+/**
+ * The policies attached at one level of the organization above an Account.
+ *
+ * AWS requires an Allow at every level between the root and the Account, so
+ * which level a policy came from decides the request rather than decorating
+ * it. The name is what a denial calls the level.
+ */
+export interface SimIamServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly policies: readonly SimIamServiceControlPolicy[];
+}
+/**
+ * The service control policies in force for one Account.
+ *
+ * Whether any apply is a separate fact from how many levels there are. An
+ * Account whose every policy has been detached is still inside the
+ * organization, and nothing allowing an action there denies it. An Account
+ * outside every organization is unrestricted. Both can hold no policy, so the
+ * levels alone cannot tell them apart.
+ */
+export interface SimIamServiceControlPolicySet {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamServiceControlPolicyLevel[];
+}
+/**
+ * Where sim IAM asks what an Account's organization allows it to do.
+ *
+ * IAM belongs to one Account and an organization spans several, so the
+ * organization is reached through this interface instead of being held by IAM
+ * itself. A standalone SimIam has no organization around it and leaves the
+ * resolver out, which is the same as an Account outside any organization.
+ */
+export interface SimIamServiceControlPolicyResolver {
+    /**
+     * The service control policies in force for an Account.
+     *
+     * A set that does not apply leaves the Account's identity and resource
+     * policies to decide the request on their own.
+     */
+    serviceControlPolicySetFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -10,6 +10,7 @@ import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAccountAuthZProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: Map<SimArn, SimIamManagedPolicy>;
@@ -24,6 +25,13 @@ interface SimIamAccountAuthZProperties {
      * standalone SimIam has no simulation around it and so no resolver.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account.
+     *
+     * A simulation with an organization in it supplies this. A standalone SimIam
+     * has none, and its Accounts sit outside any organization.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -39,6 +39,7 @@ export class SimIamAccountAuthZ {
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
             iamResolver: this.properties.iamResolver,
+            scpResolver: this.properties.scpResolver,
         });
     }
 }

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -25,6 +25,7 @@ export class SimIamActionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -10,6 +10,7 @@ import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAuthorizerProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
@@ -17,6 +18,7 @@ interface SimIamAuthorizerProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Facade for simulated IAM authorization decisions.

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -18,6 +18,7 @@ export class SimIamAuthorizer {
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/iam/authorize/sim-iam-decision-value.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export declare const SimIamPolicyDecisionValue: {
+    readonly ExplicitDeny: "ExplicitDeny";
+    readonly Allow: "Allow";
+    readonly ImplicitDeny: "ImplicitDeny";
+};
+export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];

package/dist/service/iam/authorize/sim-iam-decision-value.js

@@ -0,0 +1,12 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export const SimIamPolicyDecisionValue = {
+    ExplicitDeny: "ExplicitDeny",
+    Allow: "Allow",
+    ImplicitDeny: "ImplicitDeny",
+};

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -2,36 +2,39 @@ import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js"
 import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
-export declare const SimIamPolicyDecisionValue: {
-    readonly ExplicitDeny: "ExplicitDeny";
-    readonly Allow: "Allow";
-    readonly ImplicitDeny: "ImplicitDeny";
-};
-export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+import type { SimIamUnevaluatedStatement } from "./unevaluated/sim-iam-unevaluated-statement.type.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export declare class SimIamPolicyDecision {
     private readonly request;
-    private readonly policyDocumentParser;
+    private readonly policies;
+    private readonly scpGate;
     private readonly statementMatcher;
-    private readonly explicitDenyStatementRecords;
-    private readonly allows;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -70,6 +73,24 @@ export declare class SimIamPolicyDecision {
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy(): SimIamScpGate;
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason(): string | undefined;
     /**
      * Matching Allow statements, from both policy sides.
      *
@@ -78,6 +99,16 @@ export declare class SimIamPolicyDecision {
      * from each side.
      */
     get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The statements the simulator could not evaluate, and why.
+     *
+     * Sim IAM fails closed on a condition operator it has no implementation
+     * for, and a statement holding one matches nothing. A Deny that would have
+     * stopped the request in a real account leaves an ordinary Allow here. A
+     * decision reached over policies the simulator read in full reports
+     * nothing.
+     */
+    get unevaluatedStatements(): readonly SimIamUnevaluatedStatement[];
     /**
      * Matching Allow statements from identity-based policies.
      */
@@ -90,6 +121,4 @@ export declare class SimIamPolicyDecision {
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
-    private evaluate;
-    private evaluatePolicy;
 }

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,40 +1,52 @@
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
-import { SimIamAllowStatements } from "./allow/sim-iam-allow-statements.js";
-export const SimIamPolicyDecisionValue = {
-    ExplicitDeny: "ExplicitDeny",
-    Allow: "Allow",
-    ImplicitDeny: "ImplicitDeny",
-};
+import { SimIamPolicyEvaluation } from "./allow/sim-iam-policy-evaluation.js";
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export class SimIamPolicyDecision {
     request;
-    policyDocumentParser;
+    policies;
+    scpGate;
     statementMatcher;
-    explicitDenyStatementRecords = [];
-    allows = new SimIamAllowStatements();
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
+        const statementMatcher = new SimIamPolicyStatementMatcher(request);
         this.request = request;
-        this.policyDocumentParser = policyDocumentParser;
-        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
-        this.evaluate();
+        this.statementMatcher = statementMatcher;
+        this.policies = new SimIamPolicyEvaluation({
+            policies: [...request.identityPolicies, ...request.resourcePolicies],
+            policyDocumentParser,
+            statementMatcher,
+        });
+        this.scpGate = new SimIamScpGate({
+            serviceControlPolicies: request.serviceControlPolicies,
+            policyDocumentParser,
+            statementMatcher,
+        });
     }
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -49,13 +61,15 @@ export class SimIamPolicyDecision {
      * Final IAM decision value.
      */
     get value() {
-        if (this.explicitDenyStatementRecords.length > 0) {
+        if (this.policies.isExplicitDeny) {
             return SimIamPolicyDecisionValue.ExplicitDeny;
         }
-        if (this.request.allowRequirement.isSatisfiedBy(this.allows.sides)) {
-            return SimIamPolicyDecisionValue.Allow;
+        if (this.scpGate.value !== undefined) {
+            return this.scpGate.value;
         }
-        return SimIamPolicyDecisionValue.ImplicitDeny;
+        return this.request.allowRequirement.isSatisfiedBy(this.policies.sides)
+            ? SimIamPolicyDecisionValue.Allow
+            : SimIamPolicyDecisionValue.ImplicitDeny;
     }
     /**
      * Whether the request is allowed.
@@ -87,13 +101,38 @@ export class SimIamPolicyDecision {
      * An identity-policy Allow cannot substitute for the target role's trust.
      */
     get isAllowedByTrustPolicy() {
-        return this.allows.trust.length > 0;
+        return this.policies.allowStatements.trust.length > 0;
     }
     /**
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements() {
-        return this.explicitDenyStatementRecords;
+        return this.policies.explicitDenyStatements;
+    }
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy() {
+        return this.scpGate;
+    }
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason() {
+        if (this.policies.isExplicitDeny) {
+            return undefined;
+        }
+        return this.scpGate.denialReason(this.request.action);
     }
     /**
      * Matching Allow statements, from both policy sides.
@@ -103,46 +142,36 @@ export class SimIamPolicyDecision {
      * from each side.
      */
     get allowStatements() {
-        return this.allows.all;
+        return this.policies.allowStatements.all;
+    }
+    /**
+     * The statements the simulator could not evaluate, and why.
+     *
+     * Sim IAM fails closed on a condition operator it has no implementation
+     * for, and a statement holding one matches nothing. A Deny that would have
+     * stopped the request in a real account leaves an ordinary Allow here. A
+     * decision reached over policies the simulator read in full reports
+     * nothing.
+     */
+    get unevaluatedStatements() {
+        return this.statementMatcher.unevaluatedStatements.all;
     }
     /**
      * Matching Allow statements from identity-based policies.
      */
     get identityAllowStatements() {
-        return this.allows.identity;
+        return this.policies.allowStatements.identity;
     }
     /**
      * Matching Allow statements from resource-based policies.
      */
     get resourceAllowStatements() {
-        return this.allows.resource;
+        return this.policies.allowStatements.resource;
     }
     /**
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements() {
-        return this.allows.trust;
-    }
-    evaluate() {
-        for (const policy of [
-            ...this.request.identityPolicies,
-            ...this.request.resourcePolicies,
-        ]) {
-            this.evaluatePolicy(policy);
-        }
-    }
-    evaluatePolicy(policy) {
-        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
-        for (const statement of parsedPolicy.statements) {
-            const principal = this.statementMatcher.matches(policy, statement);
-            if (!principal.matched) {
-                continue;
-            }
-            if (statement.effect === "Deny") {
-                this.explicitDenyStatementRecords.push(statement.source);
-                continue;
-            }
-            this.allows.record(policy, statement.source, principal);
-        }
+        return this.policies.allowStatements.trust;
     }
 }

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.d.ts

@@ -15,6 +15,14 @@ export interface SimIamAuthorizationDecision {
     readonly caller: SimAwsResolvedCaller;
     readonly isAllowed: boolean;
     readonly isDenied: boolean;
+    /**
+     * How an AccessDenied error should explain this denial, where the action and
+     * the resource leave something out.
+     *
+     * A service control policy denial is the case this exists for. Absent for a
+     * denial an identity or resource policy accounts for on its own.
+     */
+    readonly denialReason?: string | undefined;
 }
 /**
  * IAM authorization capability consumed by other simulated AWS services.

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.js

@@ -32,6 +32,7 @@ export class SimIamAllowAllAuth {
             caller,
             isAllowed: true,
             isDenied: false,
+            denialReason: undefined,
         };
     }
 }

package/dist/service/iam/authorize/sim-iam-region-auth-z.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import { type SimIamInterServiceAuthZ } from "./sim-iam-inter-service-auth-z.js";
+/**
+ * The Region a global service's requests are made in.
+ *
+ * IAM, CloudFront and Route53 each have one endpoint between all Regions, and
+ * that endpoint is in us-east-1. A request to one is made in us-east-1
+ * wherever the caller is. A service control policy confining an Account to a
+ * list of Regions therefore has to leave the global services' actions out of
+ * the condition, or it loses access to all of them.
+ */
+export declare const simIamGlobalServiceRegion: AwsRegionName;
+/**
+ * The IAM one simulated service authorizes against, bound to its Region.
+ *
+ * A service is built for one Account and Region, and this is where it tells
+ * IAM which. A service built without IAM (a service constructed on its own,
+ * outside a simulation) gets the permissive fallback it has always had, bound
+ * to the same Region.
+ */
+export declare function simIamInRegion(iam: SimIamInterServiceAuthZ | undefined, regionName: AwsRegionName): SimIamInterServiceAuthZ;
+/**
+ * The IAM deciding the requests made to one Account and Region scope.
+ *
+ * A service reaching into another scope authorizes there. Both the IAM and
+ * the Region come from the scope being reached into, wherever the request
+ * came from. This is what a scheduled invocation, an event delivery and an
+ * HTTP request served on a function's behalf all decide against.
+ */
+export declare function simScopeIamAuthZ(scope: SimAwsAccountRegionContainer): SimIamInterServiceAuthZ;