@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/aws/sim-aws.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsAccountRegionContainer } from "./sim-aws-account-region-scop
 import { SimAwsServiceFactory } from "./factory/sim-aws-service-factory.js";
 import { SimAwsServiceAccessors } from "./sim-aws-service-accessors.js";
 import type { SimIamRegistry } from "../iam/registry/sim-iam-registry.js";
+import type { SimOrganizations } from "../organizations/index.js";
 import type { SimAwsPrincipal } from "./caller/sim-aws-caller.js";
 import type { SimClockControl } from "../../util/clock/sim-clock-control.js";
 import type { SimAwsProperties, SimAwsRequestCallerOptions } from "./sim-aws-properties.js";
@@ -36,6 +37,23 @@ export declare class SimAws extends SimAwsServiceAccessors {
     private readonly timekeeping;
     private readonly requestAuthentication;
     constructor(properties?: SimAwsProperties);
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations(): SimOrganizations;
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/aws/sim-aws.js

@@ -55,6 +55,25 @@ export class SimAws extends SimAwsServiceAccessors {
             clock: background,
         });
     }
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations() {
+        return this.serviceFactory.organizations;
+    }
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/bedrock/sim-bedrock.d.ts

@@ -1,6 +1,6 @@
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import { type BackgroundScheduler } from "../../util/background/background.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import type { SimConverseCommand, SimConverseCommandOutput } from "./command/converse/converse.command.js";
 import type { SimConverseStreamCommand, SimConverseStreamCommandOutput } from "./command/converse/converse-stream.command.js";

package/dist/service/bedrock/sim-bedrock.js

@@ -1,5 +1,5 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimBedrockAuthorizer } from "./command/authorize/sim-bedrock-authorizer.js";
 import { SimBedrockConverseHandler } from "./command/converse/sim-bedrock-converse.js";
@@ -31,7 +31,8 @@ export class SimBedrock {
     background;
     sdkRouter = new SimBedrockSdkCommandRouter(this);
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const commandProperties = {
             responses: this.responseRules,
             authorizer: new SimBedrockAuthorizer({ iam }),

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.d.ts

@@ -1,11 +1,19 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCdkOutContext } from "../sim-cdk-out-context.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface SimCdkAssetsPublisherProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly stackName?: string | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal the deployment runs as, which the staging Bucket is created
+     * and written to as. A real `cdk deploy` publishes assets before
+     * CloudFormation sees the template, and it publishes them as somebody; a
+     * deployment that names a caller is what says who.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.js

@@ -1,6 +1,7 @@
 import { SimCfnPseudoParameters } from "../../parameters/pseudo/sim-cfn-pseudo-parameters.js";
 import { SimCdkAssetPublications, } from "./sim-cdk-asset-publications.js";
 import { readSimCdkAssetBytes } from "./sim-cdk-asset-bytes.js";
+import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
  *
@@ -51,14 +52,15 @@ export class SimCdkAssetsPublisher {
             return;
         }
         const s3 = this.stagingS3();
-        await this.ensureBucket(s3, publication.bucketName);
+        const options = simCfnResourceCallerOptions(this.properties.caller);
+        await this.ensureBucket(s3, publication.bucketName, options);
         await s3.putObject({
             input: {
                 Bucket: publication.bucketName,
                 Key: publication.objectKey,
                 Body: assetBytes,
             },
-        });
+        }, options);
     }
     /**
      * Create the staging Bucket if this is the first asset published into it,
@@ -71,12 +73,12 @@ export class SimCdkAssetsPublisher {
      * wanted, whoever created it. Anything else, such as the name already being
      * taken in another scope, is a real failure and is reported.
      */
-    async ensureBucket(s3, bucketName) {
+    async ensureBucket(s3, bucketName, options) {
         if (s3.getSimBucketByName(bucketName) !== undefined) {
             return;
         }
         try {
-            await s3.createBucket({ input: { Bucket: bucketName } });
+            await s3.createBucket({ input: { Bucket: bucketName } }, options);
         }
         catch (error) {
             if (s3.getSimBucketByName(bucketName) === undefined) {

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { SimCfnStack, type SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
 import type { SimCreateStackCommand, SimCreateStackCommandOutput } from "./create-stack.command.js";
@@ -14,6 +15,8 @@ interface CreateStackCommandHandlerProperties {
     readonly background: BackgroundScheduler & BackgroundCompleter;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /** The principal the Stack's Resources are created as. */
+    readonly caller?: SimAwsCaller | undefined;
     readonly exports?: SimCfnExports | undefined;
 }
 /**
@@ -28,6 +31,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly background;
     private readonly cdkOutContext;
     private readonly bindings;
+    private readonly caller;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -16,15 +16,17 @@ export class CreateStackCommandHandler {
     background;
     cdkOutContext;
     bindings;
+    caller;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
         this.background = background;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
         this.exports = exports;
     }
     /**
@@ -60,6 +62,7 @@ export class CreateStackCommandHandler {
             template,
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
+            caller: this.caller,
             exports: this.exports,
         });
         this.stacks.set(stack.stackName, stack);

package/dist/service/cloudformation/command/update-stack/update-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnStack, SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
@@ -16,6 +17,11 @@ interface UpdateStackCommandHandlerProperties {
      * applied from a template file rather than from an SDK Command.
      */
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal to apply the changed template as, for an update that names
+     * one. Left out, the Stack goes on running as whoever deployed it.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /** The export names published in this Account and Region. */
     readonly exports?: SimCfnExports | undefined;
 }
@@ -30,6 +36,7 @@ export declare class UpdateStackCommandHandler implements CommandHandler<SimUpda
     private readonly stacks;
     private readonly background;
     private readonly cdkOutContext;
+    private readonly caller;
     private readonly exports;
     constructor(properties: UpdateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/update-stack/update-stack.handler.js

@@ -14,6 +14,7 @@ export class UpdateStackCommandHandler {
     stacks;
     background;
     cdkOutContext;
+    caller;
     exports;
     constructor(properties) {
         this.simAws = properties.simAws;
@@ -21,6 +22,7 @@ export class UpdateStackCommandHandler {
         this.stacks = properties.stacks;
         this.background = properties.background;
         this.cdkOutContext = properties.cdkOutContext;
+        this.caller = properties.caller;
         this.exports = properties.exports;
     }
     /**
@@ -56,7 +58,7 @@ export class UpdateStackCommandHandler {
             parameters,
             accountRegionScope: this.accountRegionScope,
             exports: this.exports,
-        }), { cdkOutContext: this.cdkOutContext });
+        }), { cdkOutContext: this.cdkOutContext, caller: this.caller });
         return {
             StackId: stack.stackName,
             $metadata: {},

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -35,6 +35,7 @@ export class SimCfnCdkOutDeployer {
             templatePath: stack.templatePath,
             stackName: stack.stackName,
             ...options,
+            caller: caller ?? plan.caller,
             transform: cdkOutBoundTransform(transform, deployed),
         });
     }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -1,4 +1,5 @@
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
 export interface SimCloudFormationDeployCdkOutProperties {
@@ -17,8 +18,13 @@ export interface SimCloudFormationDeployCdkOutProperties {
      */
     readonly stackNames?: readonly string[] | undefined;
     /**
-     * Bindings, parameters and a transform for individual Stacks, keyed the same
-     * way `stackNames` names them.
+     * The principal every Stack in the assembly is deployed as, which one named
+     * in `stackOptions` overrides for its own Stack.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Bindings, parameters, a caller and a transform for individual Stacks,
+     * keyed the same way `stackNames` names them.
      */
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
@@ -28,6 +34,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 }
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
+    readonly caller?: SimAwsCaller | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, stackOptions } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -22,6 +22,7 @@ export async function planCdkOutDeployment(properties) {
             ...stack,
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
+        caller,
         stackOptions,
     };
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -1,5 +1,6 @@
 import type { SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDeployedStack } from "../stack/sim-cfn-deployed-stack.type.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import type { SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
@@ -26,6 +27,12 @@ export type SimCfnCdkOutTemplateTransform = (template: CfnTemplateBodyRecord, de
 export interface SimCfnCdkOutStackOptions {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal this Stack is deployed as, where the assembly's own caller
+     * is not the right one for it. A pipeline Stack deployed by one role and an
+     * application Stack deployed by another is what this is for.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     readonly transform?: SimCfnCdkOutTemplateTransform | undefined;
 }
 export type SimCfnCdkOutStackOptionsByName = Record<string, SimCfnCdkOutStackOptions>;
@@ -43,8 +50,8 @@ export declare function cdkOutBoundTransform(transform: SimCfnCdkOutTemplateTran
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.js

@@ -20,17 +20,14 @@ export function cdkOutBoundTransform(transform, deployed) {
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
     const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
     const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
     if (unmatched.length > 0) {
-        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${stackNames(deploying)}.`);
+        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
     }
 }
-function stackNames(stacks) {
-    return stacks.map((stack) => stack.stackName).join(", ");
-}

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -5,6 +5,7 @@ import { type SimCloudFormationDeployTemplateFileProperties as SimCloudFormation
 import { type SimCloudFormationDeployCdkOutProperties } from "./sim-cfn-cdk-out-deployer.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
@@ -13,6 +14,15 @@ export interface SimCloudFormationCreateStackProperties {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * The synthesized CDK template file this in-memory template stands in for.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -58,6 +58,7 @@ export class SimCloudFormationTemplateDeployer {
             template: properties.template,
             parameters: properties.parameters,
             bindings: properties.bindings,
+            caller: properties.caller,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
     }
@@ -110,13 +111,13 @@ export class SimCloudFormationTemplateDeployer {
                     ParameterValue: parameterValue,
                 })),
             },
-        }, properties.cdkOutContext, properties.bindings);
+        }, properties.cdkOutContext, properties.bindings, properties.caller);
         const stack = this.stacks.get(properties.stackName);
         assertDefined(stack, `Sim CloudFormation Stack named ${properties.stackName}`);
         await stack.waitForDeployComplete();
         return stack;
     }
-    async createStackWithContext(command, cdkOutContext, bindings) {
+    async createStackWithContext(command, cdkOutContext, bindings, caller) {
         const handler = new CreateStackCommandHandler({
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
@@ -124,6 +125,7 @@ export class SimCloudFormationTemplateDeployer {
             background: this.background,
             cdkOutContext,
             bindings,
+            caller,
             exports: this.exports,
         });
         return await handler.handle(command);

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -2,6 +2,7 @@ import type { SimCloudFormationStackName } from "../stack/sim-cfn-stack.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import { type SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnTemplateFileWatchOptions } from "../watch/sim-cfn-template-watch.type.js";
 import { type SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
 export interface SimCloudFormationDeployTemplateFileProperties {
@@ -9,6 +10,15 @@ export interface SimCloudFormationDeployTemplateFileProperties {
     readonly stackName?: SimCloudFormationStackName | string | undefined;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * Adapt the parsed template before it is deployed, and again every time a
      * watched file changes.
@@ -42,6 +52,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings } = deployment;
+        const { templatePath, parameters, bindings, caller } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -31,6 +31,7 @@ export class SimCfnTemplateFileLoader {
             template,
             parameters,
             bindings,
+            caller,
             cdkOutContext,
         };
     }

package/dist/service/cloudformation/deploy/sim-cfn-template-file-updater.js

@@ -42,6 +42,7 @@ export class SimCfnTemplateFileUpdater {
             stacks: this.stacks,
             background: this.background,
             cdkOutContext: loaded.cdkOutContext,
+            caller: loaded.caller,
         });
         await handler.handle({
             input: {

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.d.ts

@@ -0,0 +1,16 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+/**
+ * The request options a Resource operation makes its service calls with.
+ *
+ * Every simulated service takes a caller the same way, so one shape carries the
+ * deployment's principal from the Stack down to the commands that create and
+ * delete Resources. Absent where the deployment named no caller, which leaves
+ * each service to its own default of the Account root.
+ */
+export type SimCfnResourceCallerOptions = {
+    readonly caller: SimAwsCaller;
+} | undefined;
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export declare function simCfnResourceCallerOptions(caller: SimAwsCaller | undefined): SimCfnResourceCallerOptions;

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.js

@@ -0,0 +1,6 @@
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export function simCfnResourceCallerOptions(caller) {
+    return caller === undefined ? undefined : { caller };
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export declare function organizationsValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.js

@@ -0,0 +1,23 @@
+import { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import { SimOrganizationalUnitCfn, SimOrganizationCfn, SimOrganizationsAccountCfn, SimOrganizationsPolicyCfn, } from "./sim-organizations-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export function organizationsValueAdapter(properties) {
+    const { simResource } = properties;
+    if (simResource instanceof SimCfnOrganization) {
+        return new SimOrganizationCfn(simResource);
+    }
+    if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+        return new SimOrganizationalUnitCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsAccount) {
+        return new SimOrganizationsAccountCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsPolicy) {
+        return new SimOrganizationsPolicyCfn(simResource);
+    }
+    return undefined;
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn.d.ts

@@ -0,0 +1,66 @@
+import type { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import type { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * CloudFormation-facing values for a simulated organization.
+ */
+export declare class SimOrganizationCfn implements SimCfnResourceValueAdapter {
+    private readonly organization;
+    constructor(organization: SimCfnOrganization);
+    /**
+     * AWS::Organizations::Organization Ref returns the organization id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists, less the management
+     * account email, which a simulation has no address for.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated organizational unit.
+ */
+export declare class SimOrganizationalUnitCfn implements SimCfnResourceValueAdapter {
+    private readonly unit;
+    constructor(unit: SimOrganizationsOrganizationalUnit);
+    /**
+     * AWS::Organizations::OrganizationalUnit Ref returns the unit id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and Name, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for an Account a template put in the
+ * organization.
+ */
+export declare class SimOrganizationsAccountCfn implements SimCfnResourceValueAdapter {
+    private readonly account;
+    constructor(account: SimCfnOrganizationsAccount);
+    /**
+     * AWS::Organizations::Account Ref returns the Account id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated service control policy.
+ */
+export declare class SimOrganizationsPolicyCfn implements SimCfnResourceValueAdapter {
+    private readonly policy;
+    constructor(policy: SimCfnOrganizationsPolicy);
+    /**
+     * AWS::Organizations::Policy Ref returns the policy id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and AwsManaged, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}