@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/iam/authorize/sim-iam-region-auth-z.js

@@ -0,0 +1,65 @@
+import { SimIamAllowAllAuth, } from "./sim-iam-inter-service-auth-z.js";
+/**
+ * The Region a global service's requests are made in.
+ *
+ * IAM, CloudFront and Route53 each have one endpoint between all Regions, and
+ * that endpoint is in us-east-1. A request to one is made in us-east-1
+ * wherever the caller is. A service control policy confining an Account to a
+ * list of Regions therefore has to leave the global services' actions out of
+ * the condition, or it loses access to all of them.
+ */
+export const simIamGlobalServiceRegion = "us-east-1";
+/**
+ * IAM authorization for the requests one Region's services make.
+ *
+ * IAM belongs to an Account and is shared by every Region in it. It has no
+ * Region of its own to derive `aws:RequestedRegion` from. A simulated service
+ * has one. It is built for a single Account and Region, and answers only the
+ * requests made to that Region. Carrying that Region into each authorization
+ * request is what lets a service control policy confine an Account to a list
+ * of Regions.
+ *
+ * A service wraps its IAM in this once, where it is wired up, and its
+ * authorization call sites go on saying nothing about the Region. A request
+ * that already names one keeps it, and that is how a service authorizes on
+ * behalf of another Region.
+ */
+class SimIamRegionAuthZ {
+    iam;
+    regionName;
+    constructor(iam, regionName) {
+        this.iam = iam;
+        this.regionName = regionName;
+    }
+    /**
+     * Evaluate an authorization request made in this Region.
+     */
+    authorize(input) {
+        return this.iam.authorize({
+            ...input,
+            region: input.region ?? this.regionName,
+        });
+    }
+}
+/**
+ * The IAM one simulated service authorizes against, bound to its Region.
+ *
+ * A service is built for one Account and Region, and this is where it tells
+ * IAM which. A service built without IAM (a service constructed on its own,
+ * outside a simulation) gets the permissive fallback it has always had, bound
+ * to the same Region.
+ */
+export function simIamInRegion(iam, regionName) {
+    return new SimIamRegionAuthZ(iam ?? new SimIamAllowAllAuth(), regionName);
+}
+/**
+ * The IAM deciding the requests made to one Account and Region scope.
+ *
+ * A service reaching into another scope authorizes there. Both the IAM and
+ * the Region come from the scope being reached into, wherever the request
+ * came from. This is what a scheduled invocation, an event delivery and an
+ * HTTP request served on a function's behalf all decide against.
+ */
+export function simScopeIamAuthZ(scope) {
+    return simIamInRegion(scope.iam(), scope.accountRegionScope.regionName);
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statement.type.d.ts

@@ -0,0 +1,31 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySourceType } from "../context/sim-iam-auth-z-context.js";
+/**
+ * One policy statement an authorization decision could not evaluate.
+ *
+ * The statement applied to the request as far as the simulator could tell:
+ * its Principal, Action and Resource all matched, and only its Condition was
+ * left undecided. Sim IAM fails closed, and the statement matched nothing. A
+ * Deny that would have stopped the request in a real account lets it through
+ * here.
+ *
+ * That is why this is recorded. A decision reporting an ordinary Allow over a
+ * statement nothing could read is an allow for the wrong reason, and a test
+ * asserting on it needs somewhere to find that out.
+ */
+export interface SimIamUnevaluatedStatement {
+    /**
+     * The policy the statement came from.
+     *
+     * This is the policy's name, falling back to the ARN of the resource
+     * holding it, and then to how the policy reached the request, since a
+     * resource policy supplied by a service need not name itself.
+     */
+    readonly policy: string;
+    /** Where the policy came from, e.g. `service-control`. */
+    readonly sourceType: SimIamAuthZPolicySourceType;
+    /** The statement, as its policy document declared it. */
+    readonly statement: SimIamPolicyDocumentStatement;
+    /** Why the simulator could not tell whether the statement matched. */
+    readonly reason: string;
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statement.type.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statements.d.ts

@@ -0,0 +1,31 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamUnevaluatedStatement } from "./sim-iam-unevaluated-statement.type.js";
+/**
+ * The statements one authorization decision could not evaluate.
+ *
+ * Sim IAM implements the condition operators multi-service tests need and
+ * fails closed on the rest, which leaves a statement it cannot read matching
+ * nothing. On a Deny that reads as an allow, and the decision otherwise looks
+ * healthy. Collecting the skips here is what lets a decision say that it
+ * reached its answer without reading everything the policies said.
+ *
+ * A statement recorded twice is kept once. One policy attached at two levels
+ * of an organization is one statement going unread, however many levels
+ * reached it.
+ */
+export declare class SimIamUnevaluatedStatements {
+    private readonly records;
+    /**
+     * Every statement left unevaluated, in the order they were reached.
+     */
+    get all(): readonly SimIamUnevaluatedStatement[];
+    /**
+     * Record a statement the simulator could not decide.
+     */
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, reason: string): void;
+    /**
+     * What to call the policy a statement came from.
+     */
+    private policyName;
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statements.js

@@ -0,0 +1,43 @@
+/**
+ * The statements one authorization decision could not evaluate.
+ *
+ * Sim IAM implements the condition operators multi-service tests need and
+ * fails closed on the rest, which leaves a statement it cannot read matching
+ * nothing. On a Deny that reads as an allow, and the decision otherwise looks
+ * healthy. Collecting the skips here is what lets a decision say that it
+ * reached its answer without reading everything the policies said.
+ *
+ * A statement recorded twice is kept once. One policy attached at two levels
+ * of an organization is one statement going unread, however many levels
+ * reached it.
+ */
+export class SimIamUnevaluatedStatements {
+    records = [];
+    /**
+     * Every statement left unevaluated, in the order they were reached.
+     */
+    get all() {
+        return this.records;
+    }
+    /**
+     * Record a statement the simulator could not decide.
+     */
+    record(policy, statement, reason) {
+        const already = this.records.some((record) => record.statement === statement && record.reason === reason);
+        if (already) {
+            return;
+        }
+        this.records.push({
+            policy: this.policyName(policy),
+            sourceType: policy.sourceType,
+            statement,
+            reason,
+        });
+    }
+    /**
+     * What to call the policy a statement came from.
+     */
+    policyName(policy) {
+        return policy.policyName ?? policy.resourceArn ?? policy.sourceType;
+    }
+}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts

@@ -3,6 +3,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamManagedPolicyAttacherProperties {
     readonly iam: SimIam;
 }
@@ -32,7 +33,7 @@ export declare class SimCfnIamManagedPolicyAttacher {
     /**
      * Attach the created Managed Policy to each of the Roles.
      */
-    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[]): Promise<void>;
+    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[], options: SimCfnResourceCallerOptions): Promise<void>;
     private roleName;
     private rejectUnsimulatedPrincipals;
 }

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js

@@ -37,10 +37,8 @@ export class SimCfnIamManagedPolicyAttacher {
     /**
      * Attach the created Managed Policy to each of the Roles.
      */
-    async attach(policyArn, roleNames) {
-        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({
-            input: { RoleName: roleName, PolicyArn: policyArn },
-        })));
+    async attach(policyArn, roleNames, options) {
+        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({ input: { RoleName: roleName, PolicyArn: policyArn } }, options)));
     }
     roleName(resource, roleName) {
         if (typeof roleName !== "string") {

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamManagedPolicy } from "../../policy/sim-iam-policy.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamManagedPolicyCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamManagedPolicyCreator {
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamManagedPolicy>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamManagedPolicy>;
     private managedPolicyName;
     private path;
     private description;

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -13,7 +13,7 @@ export class SimCfnIamManagedPolicyCreator {
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const roleNames = this.attacher.roleNames(resource, properties);
         const policyName = this.managedPolicyName(resource, properties);
         const path = this.path(resource, properties);
@@ -26,10 +26,10 @@ export class SimCfnIamManagedPolicyCreator {
                 Description: description,
                 PolicyDocument: policyDocument,
             },
-        });
+        }, options);
         const policy = this.iam.policies.get(policyCreation.Policy.Arn);
         assertDefined(policy, `Sim IAM Managed Policy ${policyCreation.Policy.Arn} after CloudFormation creation`);
-        await this.attacher.attach(policy.arn, roleNames);
+        await this.attacher.attach(policy.arn, roleNames, options);
         return policy;
     }
     managedPolicyName(resource, properties) {

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamPolicyCreatorProperties {
     readonly iam: SimIam;
 }
@@ -22,7 +23,7 @@ export declare class SimCfnIamPolicyCreator {
     /**
      * Put the inline policy onto each referenced Role and User.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<undefined>;
     private putRolePolicies;
     private putUserPolicies;
 }

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -19,30 +19,30 @@ export class SimCfnIamPolicyCreator {
     /**
      * Put the inline policy onto each referenced Role and User.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const policyProperties = this.propsParser.parse(resource, properties);
         await Promise.all([
-            this.putRolePolicies(policyProperties),
-            this.putUserPolicies(policyProperties),
+            this.putRolePolicies(policyProperties, options),
+            this.putUserPolicies(policyProperties, options),
         ]);
         return undefined;
     }
-    async putRolePolicies(policyProperties) {
+    async putRolePolicies(policyProperties, options) {
         await Promise.all(policyProperties.roleNames.map(async (roleName) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleName,
                 PolicyName: policyProperties.policyName,
                 PolicyDocument: policyProperties.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async putUserPolicies(policyProperties) {
+    async putUserPolicies(policyProperties, options) {
         await Promise.all(policyProperties.usernames.map(async (username) => this.iam.putUserPolicy({
             input: {
                 UserName: username,
                 PolicyName: policyProperties.policyName,
                 PolicyDocument: policyProperties.policyDocument,
             },
-        })));
+        }, options)));
     }
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamRole } from "../../role/sim-iam-role.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamRoleCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamRoleCreator {
     /**
      * Create a simulated Role from an AWS::IAM::Role Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamRole>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamRole>;
     private putInlinePolicies;
     private attachManagedPolicies;
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js

@@ -12,7 +12,7 @@ export class SimCfnIamRoleCreator {
     /**
      * Create a simulated Role from an AWS::IAM::Role Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const roleProperties = this.propsParser.parse(resource, properties);
         await this.iam.createRole({
             input: {
@@ -21,30 +21,30 @@ export class SimCfnIamRoleCreator {
                 Description: roleProperties.description,
                 AssumeRolePolicyDocument: roleProperties.assumeRolePolicyDocument,
             },
-        });
+        }, options);
         await Promise.all([
-            this.putInlinePolicies(roleProperties),
-            this.attachManagedPolicies(roleProperties),
+            this.putInlinePolicies(roleProperties, options),
+            this.attachManagedPolicies(roleProperties, options),
         ]);
         const role = this.iam.roles.get(roleProperties.roleName);
         assertDefined(role, `Sim IAM Role ${roleProperties.roleName} after CloudFormation creation`);
         return role;
     }
-    async putInlinePolicies(roleProperties) {
+    async putInlinePolicies(roleProperties, options) {
         await Promise.all(roleProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleProperties.roleName,
                 PolicyName: inlinePolicy.policyName,
                 PolicyDocument: inlinePolicy.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async attachManagedPolicies(roleProperties) {
+    async attachManagedPolicies(roleProperties, options) {
         await Promise.all(roleProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachRolePolicy({
             input: {
                 RoleName: roleProperties.roleName,
                 PolicyArn: policyArn,
             },
-        })));
+        }, options)));
     }
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamRoleDeleterProperties {
     readonly iam: SimIam;
 }
@@ -22,7 +23,7 @@ export declare class SimCfnIamRoleDeleter {
     /**
      * Delete the Role a CloudFormation Resource created.
      */
-    delete(resource: SimCfnResource): Promise<void>;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
     private detachPolicies;
     private deleteInlinePolicies;
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-deleter.js

@@ -20,21 +20,19 @@ export class SimCfnIamRoleDeleter {
     /**
      * Delete the Role a CloudFormation Resource created.
      */
-    async delete(resource) {
+    async delete(resource, options) {
         const role = resource.simResource;
         assertDefined(role, `sim IAM Role for CloudFormation Resource ${resource.logicalId}`);
-        await this.detachPolicies(role);
-        await this.deleteInlinePolicies(role);
-        await this.iam.deleteRole({ input: { RoleName: role.roleName } });
+        await this.detachPolicies(role, options);
+        await this.deleteInlinePolicies(role, options);
+        await this.iam.deleteRole({ input: { RoleName: role.roleName } }, options);
     }
-    async detachPolicies(role) {
-        await Promise.all([...role.attachedPolicyArns].map(async (policyArn) => this.iam.detachRolePolicy({
-            input: { RoleName: role.roleName, PolicyArn: policyArn },
-        })));
+    async detachPolicies(role, options) {
+        await Promise.all([...role.attachedPolicyArns].map(async (policyArn) => this.iam.detachRolePolicy({ input: { RoleName: role.roleName, PolicyArn: policyArn } }, options)));
     }
-    async deleteInlinePolicies(role) {
-        await Promise.all(role.inlinePolicies.keys().map(async (policyName) => this.iam.deleteRolePolicy({
-            input: { RoleName: role.roleName, PolicyName: policyName },
-        })));
+    async deleteInlinePolicies(role, options) {
+        await Promise.all(role.inlinePolicies
+            .keys()
+            .map(async (policyName) => this.iam.deleteRolePolicy({ input: { RoleName: role.roleName, PolicyName: policyName } }, options)));
     }
 }

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamResourceDeleterProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamResourceDeleter {
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     private deleteManagedPolicy;
     /**
      * Take the Managed Policy off every Role still carrying it.

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.js

@@ -16,22 +16,22 @@ export class SimCfnIamResourceDeleter {
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                await this.deleteManagedPolicy(resource);
+                await this.deleteManagedPolicy(resource, options);
                 return;
             }
             case "Policy": {
-                await this.deleteInlinePolicy(properties);
+                await this.deleteInlinePolicy(properties, options);
                 return;
             }
             case "Role": {
-                await this.roleDeleter.delete(resource);
+                await this.roleDeleter.delete(resource, options);
                 return;
             }
             case "User": {
-                await this.userDeleter.delete(resource);
+                await this.userDeleter.delete(resource, options);
                 return;
             }
             default: {
@@ -39,11 +39,11 @@ export class SimCfnIamResourceDeleter {
             }
         }
     }
-    async deleteManagedPolicy(resource) {
+    async deleteManagedPolicy(resource, options) {
         const policy = resource.simResource;
         assertDefined(policy, `sim IAM Managed Policy for CloudFormation Resource ${resource.logicalId}`);
-        await this.detachManagedPolicy(policy.arn);
-        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } });
+        await this.detachManagedPolicy(policy.arn, options);
+        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } }, options);
     }
     /**
      * Take the Managed Policy off every Role still carrying it.
@@ -54,13 +54,11 @@ export class SimCfnIamResourceDeleter {
      * Resource is deleted. A Role declared outside the Stack keeps it. This
      * clears whatever attachments are left either way.
      */
-    async detachManagedPolicy(policyArn) {
+    async detachManagedPolicy(policyArn, options) {
         await Promise.all(this.iam.roles
             .values()
             .filter((role) => role.attachedPolicyArns.has(policyArn))
-            .map(async (role) => this.iam.detachRolePolicy({
-            input: { RoleName: role.roleName, PolicyArn: policyArn },
-        })));
+            .map(async (role) => this.iam.detachRolePolicy({ input: { RoleName: role.roleName, PolicyArn: policyArn } }, options)));
     }
     /**
      * Take an AWS::IAM::Policy back off the Roles it was put on.
@@ -69,7 +67,7 @@ export class SimCfnIamResourceDeleter {
      * the template the same way creation read them. Their Refs still resolve,
      * because a Role is deleted after the policies naming it.
      */
-    async deleteInlinePolicy(properties) {
+    async deleteInlinePolicy(properties, options) {
         const policyName = properties["PolicyName"];
         const roles = properties["Roles"];
         /* v8 ignore if -- creation refused the Resource if either was missing */
@@ -78,8 +76,6 @@ export class SimCfnIamResourceDeleter {
         }
         await Promise.all(roles
             .filter((roleName) => typeof roleName === "string")
-            .map(async (roleName) => this.iam.deleteRolePolicy({
-            input: { RoleName: roleName, PolicyName: policyName },
-        })));
+            .map(async (roleName) => this.iam.deleteRolePolicy({ input: { RoleName: roleName, PolicyName: policyName } }, options)));
     }
 }

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.js

@@ -3,6 +3,7 @@ import { SimCfnIamPolicyCreator } from "./policy/sim-cfn-iam-policy-creator.js";
 import { SimCfnIamRoleCreator } from "./role/sim-cfn-iam-role-creator.js";
 import { SimCfnIamUserCreator } from "./user/sim-cfn-iam-user-creator.js";
 import { SimCfnIamResourceDeleter } from "./sim-cfn-iam-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated IAM resources.
  */
@@ -23,19 +24,21 @@ export class SimIamCloudFormationResourceFactory {
      * Create a simulated IAM resource from a CloudFormation Resource.
      */
     async create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                return await this.managedPolicyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.managedPolicyCreator.create(resource, properties, options);
             }
             case "Policy": {
-                await this.policyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                await this.policyCreator.create(resource, properties, options);
                 return;
             }
             case "Role": {
-                return await this.roleCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.roleCreator.create(resource, properties, options);
             }
             case "User": {
-                return await this.userCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.userCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim IAM CloudFormation Resource ${resourceTypeName}`);
@@ -46,6 +49,6 @@ export class SimIamCloudFormationResourceFactory {
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamUser } from "../../user/sim-iam-user.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamUser>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamUser>;
     private putInlinePolicies;
     private attachManagedPolicies;
     /**

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.js

@@ -12,45 +12,45 @@ export class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const userProperties = this.propsParser.parse(resource, properties);
         await this.iam.createUser({
             input: {
                 UserName: userProperties.userName,
                 Path: userProperties.path,
             },
-        });
+        }, options);
         await Promise.all([
-            this.putInlinePolicies(userProperties),
-            this.attachManagedPolicies(userProperties),
-            this.createLoginProfile(userProperties),
+            this.putInlinePolicies(userProperties, options),
+            this.attachManagedPolicies(userProperties, options),
+            this.createLoginProfile(userProperties, options),
         ]);
         const user = this.iam.users.get(userProperties.userName);
         assertDefined(user, `Sim IAM User ${userProperties.userName} after CloudFormation creation`);
         return user;
     }
-    async putInlinePolicies(userProperties) {
+    async putInlinePolicies(userProperties, options) {
         await Promise.all(userProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyName: inlinePolicy.policyName,
                 PolicyDocument: inlinePolicy.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async attachManagedPolicies(userProperties) {
+    async attachManagedPolicies(userProperties, options) {
         await Promise.all(userProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyArn: policyArn,
             },
-        })));
+        }, options)));
     }
     /**
      * Give the User a console password, the way real CloudFormation calls
      * CreateLoginProfile for a `LoginProfile` property.
      */
-    async createLoginProfile(userProperties) {
+    async createLoginProfile(userProperties, options) {
         const { loginProfile } = userProperties;
         if (loginProfile === undefined) {
             return;
@@ -61,6 +61,6 @@ export class SimCfnIamUserCreator {
                 Password: loginProfile.password,
                 PasswordResetRequired: loginProfile.passwordResetRequired,
             },
-        });
+        }, options);
     }
 }