@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserDeleterProperties {
     readonly iam: SimIam;
 }
@@ -12,7 +13,8 @@ interface SimCfnIamUserDeleterProperties {
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export declare class SimCfnIamUserDeleter {
     private readonly iam;
@@ -20,6 +22,6 @@ export declare class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    delete(resource: SimCfnResource): Promise<void>;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.js

@@ -8,7 +8,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export class SimCfnIamUserDeleter {
     iam;
@@ -18,11 +19,24 @@ export class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    async delete(resource) {
+    async delete(resource, options) {
         const user = resource.simResource;
         assertDefined(user, `sim IAM User for CloudFormation Resource ${resource.logicalId}`);
+        const attachedPolicyArns = [...user.attachedPolicyArns];
+        const inlinePolicies = [...user.inlinePolicies];
         user.attachedPolicyArns.clear();
         user.inlinePolicies.clear();
-        await this.iam.deleteUser({ input: { UserName: user.userName } });
+        try {
+            await this.iam.deleteUser({ input: { UserName: user.userName } }, options);
+        }
+        catch (error) {
+            for (const policyArn of attachedPolicyArns) {
+                user.attachedPolicyArns.add(policyArn);
+            }
+            for (const [policyName, document] of inlinePolicies) {
+                user.inlinePolicies.set(policyName, document);
+            }
+            throw error;
+        }
     }
 }

package/dist/service/iam/command/sim-iam-command-handlers.js

@@ -1,4 +1,5 @@
 import { SimIamActionAuthorizer } from "../authorize/sim-iam-action-authorizer.js";
+import { simIamGlobalServiceRegion, simIamInRegion, } from "../authorize/sim-iam-region-auth-z.js";
 import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
 import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
 import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
@@ -15,7 +16,11 @@ export class SimIamCommandHandlers {
     users;
     policies;
     constructor(properties) {
-        const authorizer = new SimIamActionAuthorizer({ iam: properties.iam });
+        // IAM is global rather than Region-scoped, so its own control-plane
+        // requests are made in the Region its one endpoint is in.
+        const authorizer = new SimIamActionAuthorizer({
+            iam: simIamInRegion(properties.iam, simIamGlobalServiceRegion),
+        });
         this.roles = new SimIamRoleCommandHandlers({
             accountId: properties.accountId,
             roles: properties.roles,

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -19,6 +19,14 @@ export interface SimIamAccessDeniedInput {
     readonly principal: SimAwsPrincipal;
     readonly action: string;
     readonly resource: string;
+    /**
+     * What else the message should say about why the request was denied.
+     *
+     * AWS names the source of a denial when it is something beyond the caller's
+     * own permissions, such as a service control policy. A denial the caller's
+     * identity and resource policies account for adds nothing here.
+     */
+    readonly reason?: string | undefined;
 }
 /**
  * Simulated IAM AccessDenied error.

package/dist/service/iam/error/sim-iam.error.js

@@ -27,7 +27,8 @@ export class SimIamAccessDenied extends SimIamError {
     constructor(input) {
         const iamCallerIdentifier = new SimIamCallerIdentifier();
         const callerIdentifier = iamCallerIdentifier.format(input.principal);
-        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}`, { httpStatusCode: 403 });
+        const reason = input.reason === undefined ? "" : ` ${input.reason}`;
+        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}${reason}`, { httpStatusCode: 403 });
         this.caller = input.principal;
         this.action = input.action;
         this.resource = input.resource;

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -10,6 +10,7 @@ import { SimIamSessionManager } from "./credential/session/sim-iam-session-manag
 import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimIamAccountResolver } from "./registry/sim-iam-account-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "./authorize/scp/sim-iam-scp-resolver.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
 export interface SimIamProperties {
@@ -26,6 +27,14 @@ export interface SimIamProperties {
      * simulation around it and so leaves this out.
      */
     readonly iamResolver?: SimIamAccountResolver;
+    /**
+     * Resolves the service control policies in force for this Account.
+     *
+     * Simulated Organizations supplies this when a SimAws builds IAM. A
+     * standalone SimIam has no organization around it, which is the same as an
+     * Account belonging to none.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver;
 }
 /**
  * The state and collaborators of one simulated IAM Account.

package/dist/service/iam/sim-iam-account-parts.js

@@ -48,6 +48,7 @@ export class SimIamAccountParts {
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKinesis } from "../sim-kinesis.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisResourceDeleterProperties {
     readonly kinesis: SimKinesis;
 }
@@ -12,6 +13,6 @@ export declare class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.js

@@ -10,12 +10,12 @@ export class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const stream = resource.simResource;
         assertDefined(stream, `sim Kinesis stream for CloudFormation Resource ${resource.logicalId}`);
-        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } });
+        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } }, options);
     }
 }

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.d.ts

@@ -25,6 +25,6 @@ export declare class SimKinesisCfnResourceFactory implements SimCfnServiceResour
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.js

@@ -1,5 +1,6 @@
 import { SimCfnKinesisResourceDeleter } from "./sim-cfn-kinesis-resource-deleter.js";
 import { SimCfnKinesisStreamCreator } from "./stream/sim-cfn-kinesis-stream-creator.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Kinesis resources.
  */
@@ -27,12 +28,12 @@ export class SimKinesisCfnResourceFactory {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKinesis } from "../../sim-kinesis.js";
 import type { SimKinesisStream } from "../../stream/sim-kinesis-stream.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisStreamCreatorProperties {
     readonly kinesis: SimKinesis;
 }
@@ -23,7 +24,7 @@ export declare class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKinesisStream>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKinesisStream>;
     /**
      * Move the stream's retention up to what the template asked for.
      *

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.js

@@ -23,7 +23,7 @@ export class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const streamProperties = new SimCfnKinesisStreamProperties({
             resource,
             properties,
@@ -43,8 +43,8 @@ export class SimCfnKinesisStreamCreator {
                     }),
                     ...(tags !== undefined && { Tags: tags }),
                 },
-            });
-            await this.applyRetention(name, retentionHours);
+            }, options);
+            await this.applyRetention(name, retentionHours, options);
             const stream = this.kinesis.findStream(name);
             assertDefined(stream, `sim Kinesis stream ${name} after CloudFormation creation`);
             return stream;
@@ -59,13 +59,11 @@ export class SimCfnKinesisStreamCreator {
      * which is just as well: real Kinesis refuses an increase to what the stream
      * already keeps.
      */
-    async applyRetention(name, retentionHours) {
+    async applyRetention(name, retentionHours, options) {
         if (retentionHours === undefined ||
             retentionHours <= simKinesisDefaultRetentionHours) {
             return;
         }
-        await this.kinesis.increaseStreamRetentionPeriod({
-            input: { StreamName: name, RetentionPeriodHours: retentionHours },
-        });
+        await this.kinesis.increaseStreamRetentionPeriod({ input: { StreamName: name, RetentionPeriodHours: retentionHours } }, options);
     }
 }

package/dist/service/kinesis/command/authorize/sim-kinesis-authorizer.js

@@ -37,6 +37,7 @@ export class SimKinesisAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/kinesis/sim-kinesis.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simKinesisCommands from "./command/sim-kinesis-command.types.js";
 import type { SimKinesisRequestOptions } from "./command/sim-kinesis-request-options.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";

package/dist/service/kinesis/sim-kinesis.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKinesisCommands } from "./command/sim-kinesis-commands.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";
 import { SimKinesisSdkCommandRouter } from "./sdk/sim-kinesis-sdk-command-router.js";
@@ -32,7 +32,8 @@ export class SimKinesis {
         kinesis: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimKinesisCommands({
             streams: this.streams,

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsAlias } from "../../key/sim-kms-alias.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsAliasCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,6 +20,6 @@ export declare class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsAlias>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsAlias>;
 }
 export {};

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const aliasProperties = new SimCfnKmsAliasProperties({
             resource,
             properties,
@@ -27,7 +27,7 @@ export class SimCfnKmsAliasCreator {
                 AliasName: aliasName,
                 TargetKeyId: aliasProperties.targetKeyId(),
             },
-        });
+        }, options);
         const alias = this.kms.findAlias(aliasName);
         assertDefined(alias, `sim KMS alias ${aliasName} after CloudFormation creation`);
         return alias;

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsKey } from "../../key/sim-kms-key.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsKeyCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,16 +20,15 @@ export declare class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsKey>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsKey>;
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
     private applyEnabled;
 }

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const keyProperties = new SimCfnKmsKeyProperties({ resource, properties });
         const created = await this.kms.createKey({
             input: {
@@ -26,27 +26,27 @@ export class SimCfnKmsKeyCreator {
                 KeyUsage: keyProperties.keyUsage(),
                 Origin: keyProperties.origin(),
             },
-        });
+        }, options);
         const keyId = created.KeyMetadata?.KeyId;
         assertDefined(keyId, `sim KMS key ID after CloudFormation creation for ${resource.logicalId}`);
         const key = this.kms.findKey(keyId);
         assertDefined(key, `sim KMS key ${keyId} after CloudFormation creation`);
-        this.applyEnabled(key, keyProperties.enabled());
+        await this.applyEnabled(keyId, keyProperties.enabled(), options);
         return key;
     }
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
-    applyEnabled(key, enabled) {
-        if (!enabled) {
-            key.disable();
+    async applyEnabled(keyId, enabled, options) {
+        if (enabled) {
+            return;
         }
+        await this.kms.disableKey({ input: { KeyId: keyId } }, options);
     }
 }

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsResourceDeleterProperties {
     readonly kms: SimKms;
 }
@@ -17,6 +18,6 @@ export declare class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.js

@@ -15,20 +15,18 @@ export class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         switch (resourceTypeName) {
             case "Key": {
                 const key = resource.simResource;
                 assertDefined(key, `sim KMS Key for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } });
+                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } }, options);
                 return;
             }
             case "Alias": {
                 const alias = resource.simResource;
                 assertDefined(alias, `sim KMS Alias for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.deleteAlias({
-                    input: { AliasName: alias.aliasName },
-                });
+                await this.kms.deleteAlias({ input: { AliasName: alias.aliasName } }, options);
                 return;
             }
             default: {

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.type.js";
 interface SimKmsCfnResourceFactoryProperties {
     readonly kms: SimKms;
 }
@@ -22,6 +23,6 @@ export declare class SimKmsCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnKmsAliasCreator } from "./alias/sim-cfn-kms-alias-creator.js";
 import { SimCfnKmsKeyCreator } from "./key/sim-cfn-kms-key-creator.js";
 import { SimCfnKmsResourceDeleter } from "./sim-cfn-kms-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated KMS resources.
  */
@@ -21,12 +22,13 @@ export class SimKmsCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "Key": {
-                return await this.keyCreator.create(resource, properties);
+                return await this.keyCreator.create(resource, properties, options);
             }
             case "Alias": {
-                return await this.aliasCreator.create(resource, properties);
+                return await this.aliasCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim KMS CloudFormation Resource ${resourceTypeName}`);
@@ -36,7 +38,7 @@ export class SimKmsCfnResourceFactory {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -45,6 +45,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource: key.arn,
             });
@@ -65,6 +66,7 @@ export class SimKmsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/kms/sim-kms-commands.d.ts

@@ -1,6 +1,6 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimKmsAliasCommands } from "./command/alias/sim-kms-alias-commands.js";
 import { SimKmsCryptoCommands } from "./command/crypto/sim-kms-crypto-commands.js";
 import { SimKmsGenerateDataKey } from "./command/crypto/sim-kms-generate-data-key.js";

package/dist/service/kms/sim-kms-commands.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKmsAliasCommands } from "./command/alias/sim-kms-alias-commands.js";
 import { SimKmsAuthorizer } from "./command/authorize/sim-kms-authorizer.js";
 import { SimKmsCryptoCommands } from "./command/crypto/sim-kms-crypto-commands.js";
@@ -33,7 +33,8 @@ export class SimKmsCommands {
     generateDataKey;
     background;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const keyFactory = new SimKmsKeyFactory({
             accountRegionScope,
             clock: background,

package/dist/service/lambda/cfn/alias/sim-cfn-lambda-alias-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaFunctionAlias } from "../../function/version/sim-lambda-function-alias.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaAliasCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -24,6 +25,6 @@ export declare class SimCfnLambdaAliasCreator {
     /**
      * Create an alias from an AWS::Lambda::Alias Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaFunctionAlias>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLambdaFunctionAlias>;
 }
 export {};

package/dist/service/lambda/cfn/alias/sim-cfn-lambda-alias-creator.js

@@ -22,7 +22,7 @@ export class SimCfnLambdaAliasCreator {
     /**
      * Create an alias from an AWS::Lambda::Alias Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const functionName = simCfnLambdaTargetFunctionName(this.propertyParser.requiredString(resource, properties["FunctionName"], "FunctionName"));
         const name = this.propertyParser.requiredString(resource, properties["Name"], "Name");
         await this.lambda.createAlias({
@@ -32,7 +32,7 @@ export class SimCfnLambdaAliasCreator {
                 FunctionVersion: this.propertyParser.requiredString(resource, properties["FunctionVersion"], "FunctionVersion"),
                 Description: this.propertyParser.optionalString(resource, properties["Description"], "Description"),
             },
-        });
+        }, options);
         const alias = this.lambda.getSimFunctionAlias(functionName, name);
         assertDefined(alias, `Sim Lambda alias ${name} of ${functionName} after CloudFormation creation`);
         return alias;

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaEventInvokeConfig } from "../../function/event-invoke/sim-lambda-event-invoke-config.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaEventInvokeConfigCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -20,6 +21,6 @@ export declare class SimCfnLambdaEventInvokeConfigCreator {
     /**
      * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaEventInvokeConfig>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLambdaEventInvokeConfig>;
 }
 export {};

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js

@@ -17,12 +17,12 @@ export class SimCfnLambdaEventInvokeConfigCreator {
     /**
      * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const { functionName, qualifier, input } = new SimCfnLambdaEventInvokeConfigProperties({
             resource,
             properties,
         }).createInput();
-        await this.lambda.putFunctionEventInvokeConfig({ input });
+        await this.lambda.putFunctionEventInvokeConfig({ input }, options);
         const config = this.lambda.getSimEventInvokeConfig(functionName, qualifier);
         assertDefined(config, `Sim Lambda event invoke config ${resource.logicalId} after ` +
             "CloudFormation creation");