@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/cognito/cfn/sim-cfn-cognito-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnCognitoResourceDeleterProperties {
     readonly cognito: SimCognitoIdentityProvider;
 }
@@ -35,7 +36,7 @@ export declare class SimCfnCognitoResourceDeleter {
      * The deletions are held by Resource type name rather than switched on, so
      * this stays one lookup however many types the service deploys.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
     /**
      * What deletes each Resource type this service deploys.
      */

package/dist/service/cognito/cfn/sim-cfn-cognito-resource-deleter.js

@@ -40,77 +40,71 @@ export class SimCfnCognitoResourceDeleter {
      * The deletions are held by Resource type name rather than switched on, so
      * this stays one lookup however many types the service deploys.
      */
-    async delete(resourceTypeName, resource) {
-        const deletion = this.deletions().get(resourceTypeName) ??
+    async delete(resourceTypeName, resource, options) {
+        const deletion = this.deletions(options).get(resourceTypeName) ??
             SimCfnCognitoResourceDeleter.unsupported(resourceTypeName);
         await deletion(resource);
     }
     /**
      * What deletes each Resource type this service deploys.
      */
-    deletions() {
+    deletions(options) {
         return new Map([
             [
                 "UserPool",
                 async (resource) => {
-                    await this.deleteUserPool(resource);
+                    await this.deleteUserPool(resource, options);
                 },
             ],
             [
                 "UserPoolClient",
                 async (resource) => {
-                    await this.deleteClient(resource);
+                    await this.deleteClient(resource, options);
                 },
             ],
             [
                 "UserPoolGroup",
                 async (resource) => {
-                    await this.deleteGroup(resource);
+                    await this.deleteGroup(resource, options);
                 },
             ],
             [
                 "UserPoolDomain",
                 async (resource) => {
-                    await this.deleteDomain(resource);
+                    await this.deleteDomain(resource, options);
                 },
             ],
             [
                 "UserPoolIdentityProvider",
                 async (resource) => {
-                    await this.deleteIdentityProvider(resource);
+                    await this.deleteIdentityProvider(resource, options);
                 },
             ],
         ]);
     }
-    async deleteDomain(resource) {
+    async deleteDomain(resource, options) {
         const domain = SimCfnCognitoResourceDeleter.created(resource, "domain");
-        await this.cognito.deleteUserPoolDomain({
-            input: { UserPoolId: domain.userPoolId, Domain: domain.value },
-        });
+        await this.cognito.deleteUserPoolDomain({ input: { UserPoolId: domain.userPoolId, Domain: domain.value } }, options);
     }
-    async deleteIdentityProvider(resource) {
+    async deleteIdentityProvider(resource, options) {
         const provider = SimCfnCognitoResourceDeleter.created(resource, "identity provider");
         await this.cognito.deleteIdentityProvider({
             input: {
                 UserPoolId: provider.userPoolId,
                 ProviderName: provider.name,
             },
-        });
+        }, options);
     }
-    async deleteUserPool(resource) {
+    async deleteUserPool(resource, options) {
         const userPool = SimCfnCognitoResourceDeleter.created(resource, "user pool");
-        await this.cognito.deleteUserPool({ input: { UserPoolId: userPool.id } });
+        await this.cognito.deleteUserPool({ input: { UserPoolId: userPool.id } }, options);
     }
-    async deleteClient(resource) {
+    async deleteClient(resource, options) {
         const client = SimCfnCognitoResourceDeleter.created(resource, "app client");
-        await this.cognito.deleteUserPoolClient({
-            input: { UserPoolId: client.userPoolId, ClientId: client.id },
-        });
+        await this.cognito.deleteUserPoolClient({ input: { UserPoolId: client.userPoolId, ClientId: client.id } }, options);
     }
-    async deleteGroup(resource) {
+    async deleteGroup(resource, options) {
         const group = SimCfnCognitoResourceDeleter.created(resource, "group");
-        await this.cognito.deleteGroup({
-            input: { UserPoolId: group.userPoolId, GroupName: group.name },
-        });
+        await this.cognito.deleteGroup({ input: { UserPoolId: group.userPoolId, GroupName: group.name } }, options);
     }
 }

package/dist/service/cognito/cfn/sim-cfn-cognito-resource-factory.d.ts

@@ -1,5 +1,5 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
 interface SimCognitoCfnResourceFactoryProperties {
     readonly cognito: SimCognitoIdentityProvider;
@@ -26,6 +26,6 @@ export declare class SimCognitoCfnResourceFactory implements SimCfnServiceResour
     /**
      * Delete a simulated Cognito resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/cognito/cfn/sim-cfn-cognito-resource-factory.js

@@ -1,3 +1,4 @@
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnCognitoClientCreator } from "./client/sim-cfn-cognito-client-creator.js";
 import { SimCfnCognitoDomainCreator } from "./domain/sim-cfn-cognito-domain-creator.js";
 import { SimCfnCognitoIdpCreator } from "./idp/sim-cfn-cognito-idp-creator.js";
@@ -32,21 +33,22 @@ export class SimCognitoCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "UserPool": {
-                return await this.userPoolCreator.create(resource, properties);
+                return await this.userPoolCreator.create(resource, properties, options);
             }
             case "UserPoolClient": {
-                return await this.clientCreator.create(resource, properties);
+                return await this.clientCreator.create(resource, properties, options);
             }
             case "UserPoolGroup": {
-                return await this.groupCreator.create(resource, properties);
+                return await this.groupCreator.create(resource, properties, options);
             }
             case "UserPoolDomain": {
-                return await this.domainCreator.create(resource, properties);
+                return await this.domainCreator.create(resource, properties, options);
             }
             case "UserPoolIdentityProvider": {
-                return await this.idpCreator.create(resource, properties);
+                return await this.idpCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim Cognito CloudFormation Resource ${resourceTypeName}`);
@@ -56,7 +58,7 @@ export class SimCognitoCfnResourceFactory {
     /**
      * Delete a simulated Cognito resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCognitoIdentityProvider } from "../../sim-cognito-identity-provider.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnCognitoUserPoolCreatorProperties {
     readonly cognito: SimCognitoIdentityProvider;
 }
@@ -20,7 +21,7 @@ export declare class SimCfnCognitoUserPoolCreator {
     /**
      * Create a user pool from an AWS::Cognito::UserPool Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimCognitoUserPool>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimCognitoUserPool>;
     /**
      * Configure the pool's MFA, where the template asked for any.
      *

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.js

@@ -17,17 +17,15 @@ export class SimCfnCognitoUserPoolCreator {
     /**
      * Create a user pool from an AWS::Cognito::UserPool Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const poolProperties = new SimCfnCognitoUserPoolProperties({
             resource,
             properties,
         });
-        const created = await this.cognito.createUserPool({
-            input: poolProperties.createUserPoolInput(),
-        });
+        const created = await this.cognito.createUserPool({ input: poolProperties.createUserPoolInput() }, options);
         const userPoolId = created.UserPool?.Id;
         assertDefined(userPoolId, `sim Cognito user pool id after CloudFormation creation for ${resource.logicalId}`);
-        await this.setMfaConfig(poolProperties, userPoolId);
+        await this.setMfaConfig(poolProperties, userPoolId, options);
         return this.cognito.userPool(userPoolId);
     }
     /**
@@ -38,11 +36,11 @@ export class SimCfnCognitoUserPoolCreator {
      * creation, so a stack that deploys here needs the same
      * `cognito-idp:SetUserPoolMfaConfig` permission it needs on real AWS.
      */
-    async setMfaConfig(poolProperties, userPoolId) {
+    async setMfaConfig(poolProperties, userPoolId, options) {
         const input = poolProperties.setUserPoolMfaConfigInput(userPoolId);
         if (input === undefined) {
             return;
         }
-        await this.cognito.setUserPoolMfaConfig({ input });
+        await this.cognito.setUserPoolMfaConfig({ input }, options);
     }
 }

package/dist/service/cognito/command/authorize/sim-cognito-authorizer.js

@@ -45,6 +45,7 @@ export class SimCognitoAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/cognito/sim-cognito-identity-provider.d.ts

@@ -2,7 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import { SimAwsMessageLog } from "../aws/message/sim-aws-message-log.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { type SimWafProtection } from "../wafv2/association/sim-waf-protection.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
 import { SimCognitoDomainRegistry } from "./registry/sim-cognito-domain-registry.js";

package/dist/service/cognito/sim-cognito-identity-provider.js

@@ -1,7 +1,7 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimAwsMessageLog } from "../aws/message/sim-aws-message-log.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimWafNoProtection, } from "../wafv2/association/sim-waf-protection.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
 import { SimCognitoCommands } from "./command/sim-cognito-commands.js";
@@ -38,7 +38,8 @@ export class SimCognitoIdentityProvider extends SimCognitoUserPools {
         cognito: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), domainRegistry = new SimCognitoDomainRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), emailSenders = new SimCognitoNoEmailSenders(), webAcls = new SimWafNoProtection(), messageLog = new SimAwsMessageLog(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), domainRegistry = new SimCognitoDomainRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), emailSenders = new SimCognitoNoEmailSenders(), webAcls = new SimWafNoProtection(), messageLog = new SimAwsMessageLog(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const pools = new SimCognitoUserPoolStore({
             registry: userPoolRegistry,
             domains: domainRegistry,

package/dist/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.js

@@ -1,5 +1,6 @@
 import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
 import { parseSimLambdaFunctionArn, } from "../../../lambda/function/sim-lambda-function-arn-parts.js";
+import { simScopeIamAuthZ } from "../../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * The service principal real Cognito invokes a user pool trigger as.
  */
@@ -91,7 +92,7 @@ export class SimAwsCognitoTriggerFunctions {
     }
     iam(target) {
         const { accountId, regionName } = target.simFunction.accountRegionScope;
-        return this.simAws.accountRegionScope(accountId, regionName).iam();
+        return simScopeIamAuthZ(this.simAws.accountRegionScope(accountId, regionName));
     }
 }
 /**

package/dist/service/dynamodb/cfn/global-table/sim-cfn-dynamodb-global-table-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimCfnDynamoDbTableCreator } from "../table/sim-cfn-dynamodb-table-creator.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnDynamoDbGlobalTableCreatorProperties {
     readonly tableCreator: SimCfnDynamoDbTableCreator;
 }
@@ -20,6 +21,6 @@ export declare class SimCfnDynamoDbGlobalTableCreator {
     /**
      * Create a table from an AWS::DynamoDB::GlobalTable Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimDynamoDbTable>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimDynamoDbTable>;
 }
 export {};

package/dist/service/dynamodb/cfn/global-table/sim-cfn-dynamodb-global-table-creator.js

@@ -16,11 +16,11 @@ export class SimCfnDynamoDbGlobalTableCreator {
     /**
      * Create a table from an AWS::DynamoDB::GlobalTable Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const globalTable = new SimCfnDynamoDbGlobalTableProperties({
             resource,
             properties,
         });
-        return await this.tableCreator.create(resource, globalTable.tableProperties());
+        return await this.tableCreator.create(resource, globalTable.tableProperties(), options);
     }
 }

package/dist/service/dynamodb/cfn/sim-cfn-dynamodb-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimDynamoDb } from "../sim-dynamodb.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnDynamoDbResourceDeleterProperties {
     readonly dynamoDb: SimDynamoDb;
 }
@@ -17,6 +18,6 @@ export declare class SimCfnDynamoDbResourceDeleter {
      * Delete a simulated DynamoDB resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/dynamodb/cfn/sim-cfn-dynamodb-resource-deleter.js

@@ -15,14 +15,12 @@ export class SimCfnDynamoDbResourceDeleter {
      * Delete a simulated DynamoDB resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== "Table" && resourceTypeName !== "GlobalTable") {
             throw new Error(`Unsupported sim DynamoDB CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const table = resource.simResource;
         assertDefined(table, `sim DynamoDB table for CloudFormation Resource ${resource.logicalId}`);
-        await this.dynamoDb.deleteTable({
-            input: { TableName: table.tableName },
-        });
+        await this.dynamoDb.deleteTable({ input: { TableName: table.tableName } }, options);
     }
 }

package/dist/service/dynamodb/cfn/sim-cfn-dynamodb-resource-factory.d.ts

@@ -1,5 +1,5 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimDynamoDb } from "../sim-dynamodb.js";
 interface SimDynamoDbCfnResourceFactoryProperties {
     readonly dynamoDb: SimDynamoDb;
@@ -25,6 +25,6 @@ export declare class SimDynamoDbCfnResourceFactory implements SimCfnServiceResou
     /**
      * Delete a simulated DynamoDB resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/dynamodb/cfn/sim-cfn-dynamodb-resource-factory.js

@@ -1,3 +1,4 @@
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnDynamoDbGlobalTableCreator } from "./global-table/sim-cfn-dynamodb-global-table-creator.js";
 import { SimCfnDynamoDbTableCreator } from "./table/sim-cfn-dynamodb-table-creator.js";
 import { SimCfnDynamoDbResourceDeleter } from "./sim-cfn-dynamodb-resource-deleter.js";
@@ -30,12 +31,13 @@ export class SimDynamoDbCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "Table": {
-                return await this.tableCreator.create(resource, properties);
+                return await this.tableCreator.create(resource, properties, options);
             }
             case "GlobalTable": {
-                return await this.globalTableCreator.create(resource, properties);
+                return await this.globalTableCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim DynamoDB CloudFormation Resource ${resourceTypeName}`);
@@ -45,7 +47,7 @@ export class SimDynamoDbCfnResourceFactory {
     /**
      * Delete a simulated DynamoDB resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/dynamodb/cfn/table/sim-cfn-dynamodb-table-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimDynamoDb } from "../../sim-dynamodb.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnDynamoDbTableCreatorProperties {
     readonly dynamoDb: SimDynamoDb;
 }
@@ -20,7 +21,7 @@ export declare class SimCfnDynamoDbTableCreator {
     /**
      * Create a table from an AWS::DynamoDB::Table Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimDynamoDbTable>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimDynamoDbTable>;
     /**
      * Switch the table's time to live on, when the template asked for it.
      *

package/dist/service/dynamodb/cfn/table/sim-cfn-dynamodb-table-creator.js

@@ -17,7 +17,7 @@ export class SimCfnDynamoDbTableCreator {
     /**
      * Create a table from an AWS::DynamoDB::Table Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const tableProperties = new SimCfnDynamoDbTableProperties({
             resource,
             properties,
@@ -38,8 +38,8 @@ export class SimCfnDynamoDbTableCreator {
                 StreamSpecification: tableProperties.streamSpecification(),
                 Tags: tableProperties.tags(),
             },
-        });
-        await this.applyTimeToLive(name, tableProperties);
+        }, options);
+        await this.applyTimeToLive(name, tableProperties, options);
         const table = this.dynamoDb.findTable(name);
         assertDefined(table, `sim DynamoDB table ${name} after CloudFormation creation`);
         return table;
@@ -56,13 +56,11 @@ export class SimCfnDynamoDbTableCreator {
      * the state it is already in, so there is nothing to send. The specification
      * is still read, so a template holding the wrong shape is still refused.
      */
-    async applyTimeToLive(name, tableProperties) {
+    async applyTimeToLive(name, tableProperties, options) {
         const specification = tableProperties.timeToLiveSpecification();
         if (specification?.Enabled !== true) {
             return;
         }
-        await this.dynamoDb.updateTimeToLive({
-            input: { TableName: name, TimeToLiveSpecification: specification },
-        });
+        await this.dynamoDb.updateTimeToLive({ input: { TableName: name, TimeToLiveSpecification: specification } }, options);
     }
 }

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -56,6 +56,7 @@ export class SimDynamoDbAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/dynamodb/sim-dynamodb.js

@@ -5,7 +5,7 @@ import { SimDynamoDbStreamStore } from "./stream/sim-dynamodb-stream-store.js";
 import { SimDynamoDbStreams } from "./sim-dynamodb-streams.js";
 import { SimDynamoDbTableStore } from "./table/sim-dynamodb-table-store.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimDynamoDatabaseSdkCommandRouter } from "./sdk/sim-dynamodb-sdk-command-router.js";
 import { SimDynamoDbCfnResourceFactory } from "./cfn/sim-cfn-dynamodb-resource-factory.js";
 /**
@@ -28,7 +28,8 @@ export class SimDynamoDb {
         dynamoDb: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimDynamoDbCommandHandlers({
             tables: this.tables,

package/dist/service/ecs/cfn/cluster/sim-cfn-ecs-cluster-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEcsCluster } from "../../cluster/sim-ecs-cluster.js";
 import type { SimEcs } from "../../sim-ecs.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnEcsClusterCreatorProperties {
     readonly ecs: SimEcs;
 }
@@ -19,7 +20,7 @@ export declare class SimCfnEcsClusterCreator {
     /**
      * Create a cluster from an AWS::ECS::Cluster Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimEcsCluster>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimEcsCluster>;
     /**
      * Delete a cluster created from an AWS::ECS::Cluster Resource.
      *
@@ -27,6 +28,6 @@ export declare class SimCfnEcsClusterCreator {
      * `DeleteCluster` does, so something still holding its ARN can find out what
      * became of it after the stack has gone.
      */
-    delete(cluster: SimEcsCluster): Promise<void>;
+    delete(cluster: SimEcsCluster, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/ecs/cfn/cluster/sim-cfn-ecs-cluster-creator.js

@@ -15,14 +15,14 @@ export class SimCfnEcsClusterCreator {
     /**
      * Create a cluster from an AWS::ECS::Cluster Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const clusterProperties = new SimCfnEcsClusterProperties({
             resource,
             properties,
         });
         const input = clusterProperties.createClusterInput();
         clusterProperties.recordIgnoredProperties();
-        await this.ecs.createCluster({ input });
+        await this.ecs.createCluster({ input }, options);
         return this.ecs.cluster(clusterProperties.clusterName());
     }
     /**
@@ -32,9 +32,7 @@ export class SimCfnEcsClusterCreator {
      * `DeleteCluster` does, so something still holding its ARN can find out what
      * became of it after the stack has gone.
      */
-    async delete(cluster) {
-        await this.ecs.deleteCluster({
-            input: { cluster: cluster.clusterName },
-        });
+    async delete(cluster, options) {
+        await this.ecs.deleteCluster({ input: { cluster: cluster.clusterName } }, options);
     }
 }

package/dist/service/ecs/cfn/service/sim-cfn-ecs-service-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEcsService } from "../../service/sim-ecs-service.js";
 import type { SimEcs } from "../../sim-ecs.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnEcsServiceCreatorProperties {
     readonly ecs: SimEcs;
 }
@@ -25,7 +26,7 @@ export declare class SimCfnEcsServiceCreator {
     /**
      * Create a service from an AWS::ECS::Service Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimEcsService>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimEcsService>;
     /**
      * Delete a service created from an AWS::ECS::Service Resource.
      *
@@ -35,6 +36,6 @@ export declare class SimCfnEcsServiceCreator {
      * same thing: the tasks stop, and the service is left `INACTIVE` rather than
      * removed, so something holding its ARN can still find out what became of it.
      */
-    delete(service: SimEcsService): Promise<void>;
+    delete(service: SimEcsService, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/ecs/cfn/service/sim-cfn-ecs-service-creator.js

@@ -22,14 +22,14 @@ export class SimCfnEcsServiceCreator {
     /**
      * Create a service from an AWS::ECS::Service Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const serviceProperties = new SimCfnEcsServiceProperties({
             resource,
             properties,
         });
         const input = serviceProperties.createServiceInput();
         serviceProperties.recordIgnoredProperties();
-        const created = await this.ecs.createService({ input });
+        const created = await this.ecs.createService({ input }, options);
         const serviceArn = created.service?.serviceArn;
         assertDefined(serviceArn, `sim ECS service ARN for CloudFormation Resource ${resource.logicalId}`);
         return this.ecs.service(serviceArn);
@@ -43,13 +43,13 @@ export class SimCfnEcsServiceCreator {
      * same thing: the tasks stop, and the service is left `INACTIVE` rather than
      * removed, so something holding its ARN can still find out what became of it.
      */
-    async delete(service) {
+    async delete(service, options) {
         await this.ecs.deleteService({
             input: {
                 cluster: service.clusterName,
                 service: service.serviceName,
                 force: true,
             },
-        });
+        }, options);
     }
 }

package/dist/service/ecs/cfn/sim-cfn-ecs-created-resource.d.ts

@@ -0,0 +1,5 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The simulated resource a Resource created, which a teardown reaches it by.
+ */
+export declare function simCfnEcsCreatedResource<T extends object>(resource: SimCfnResource, described: string): T;

package/dist/service/ecs/cfn/sim-cfn-ecs-created-resource.js

@@ -0,0 +1,9 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+/**
+ * The simulated resource a Resource created, which a teardown reaches it by.
+ */
+export function simCfnEcsCreatedResource(resource, described) {
+    const created = resource.simResource;
+    assertDefined(created, `sim ECS ${described} for CloudFormation Resource ${resource.logicalId}`);
+    return created;
+}

package/dist/service/ecs/cfn/sim-ecs-cfn-resource-factory.d.ts

@@ -1,5 +1,5 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimEcs } from "../sim-ecs.js";
 interface SimEcsCfnResourceFactoryProperties {
     readonly ecs: SimEcs;
@@ -25,6 +25,6 @@ export declare class SimEcsCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated ECS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};