@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.js

@@ -16,22 +16,22 @@ export class SimCfnIamResourceDeleter {
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                await this.deleteManagedPolicy(resource);
+                await this.deleteManagedPolicy(resource, options);
                 return;
             }
             case "Policy": {
-                await this.deleteInlinePolicy(properties);
+                await this.deleteInlinePolicy(properties, options);
                 return;
             }
             case "Role": {
-                await this.roleDeleter.delete(resource);
+                await this.roleDeleter.delete(resource, options);
                 return;
             }
             case "User": {
-                await this.userDeleter.delete(resource);
+                await this.userDeleter.delete(resource, options);
                 return;
             }
             default: {
@@ -39,11 +39,11 @@ export class SimCfnIamResourceDeleter {
             }
         }
     }
-    async deleteManagedPolicy(resource) {
+    async deleteManagedPolicy(resource, options) {
         const policy = resource.simResource;
         assertDefined(policy, `sim IAM Managed Policy for CloudFormation Resource ${resource.logicalId}`);
-        await this.detachManagedPolicy(policy.arn);
-        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } });
+        await this.detachManagedPolicy(policy.arn, options);
+        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } }, options);
     }
     /**
      * Take the Managed Policy off every Role still carrying it.
@@ -54,13 +54,11 @@ export class SimCfnIamResourceDeleter {
      * Resource is deleted. A Role declared outside the Stack keeps it. This
      * clears whatever attachments are left either way.
      */
-    async detachManagedPolicy(policyArn) {
+    async detachManagedPolicy(policyArn, options) {
         await Promise.all(this.iam.roles
             .values()
             .filter((role) => role.attachedPolicyArns.has(policyArn))
-            .map(async (role) => this.iam.detachRolePolicy({
-            input: { RoleName: role.roleName, PolicyArn: policyArn },
-        })));
+            .map(async (role) => this.iam.detachRolePolicy({ input: { RoleName: role.roleName, PolicyArn: policyArn } }, options)));
     }
     /**
      * Take an AWS::IAM::Policy back off the Roles it was put on.
@@ -69,7 +67,7 @@ export class SimCfnIamResourceDeleter {
      * the template the same way creation read them. Their Refs still resolve,
      * because a Role is deleted after the policies naming it.
      */
-    async deleteInlinePolicy(properties) {
+    async deleteInlinePolicy(properties, options) {
         const policyName = properties["PolicyName"];
         const roles = properties["Roles"];
         /* v8 ignore if -- creation refused the Resource if either was missing */
@@ -78,8 +76,6 @@ export class SimCfnIamResourceDeleter {
         }
         await Promise.all(roles
             .filter((roleName) => typeof roleName === "string")
-            .map(async (roleName) => this.iam.deleteRolePolicy({
-            input: { RoleName: roleName, PolicyName: policyName },
-        })));
+            .map(async (roleName) => this.iam.deleteRolePolicy({ input: { RoleName: roleName, PolicyName: policyName } }, options)));
     }
 }

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.js

@@ -3,6 +3,7 @@ import { SimCfnIamPolicyCreator } from "./policy/sim-cfn-iam-policy-creator.js";
 import { SimCfnIamRoleCreator } from "./role/sim-cfn-iam-role-creator.js";
 import { SimCfnIamUserCreator } from "./user/sim-cfn-iam-user-creator.js";
 import { SimCfnIamResourceDeleter } from "./sim-cfn-iam-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated IAM resources.
  */
@@ -23,19 +24,21 @@ export class SimIamCloudFormationResourceFactory {
      * Create a simulated IAM resource from a CloudFormation Resource.
      */
     async create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                return await this.managedPolicyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.managedPolicyCreator.create(resource, properties, options);
             }
             case "Policy": {
-                await this.policyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                await this.policyCreator.create(resource, properties, options);
                 return;
             }
             case "Role": {
-                return await this.roleCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.roleCreator.create(resource, properties, options);
             }
             case "User": {
-                return await this.userCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.userCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim IAM CloudFormation Resource ${resourceTypeName}`);
@@ -46,6 +49,6 @@ export class SimIamCloudFormationResourceFactory {
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamUser } from "../../user/sim-iam-user.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamUser>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamUser>;
     private putInlinePolicies;
     private attachManagedPolicies;
     /**

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.js

@@ -12,45 +12,45 @@ export class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const userProperties = this.propsParser.parse(resource, properties);
         await this.iam.createUser({
             input: {
                 UserName: userProperties.userName,
                 Path: userProperties.path,
             },
-        });
+        }, options);
         await Promise.all([
-            this.putInlinePolicies(userProperties),
-            this.attachManagedPolicies(userProperties),
-            this.createLoginProfile(userProperties),
+            this.putInlinePolicies(userProperties, options),
+            this.attachManagedPolicies(userProperties, options),
+            this.createLoginProfile(userProperties, options),
         ]);
         const user = this.iam.users.get(userProperties.userName);
         assertDefined(user, `Sim IAM User ${userProperties.userName} after CloudFormation creation`);
         return user;
     }
-    async putInlinePolicies(userProperties) {
+    async putInlinePolicies(userProperties, options) {
         await Promise.all(userProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyName: inlinePolicy.policyName,
                 PolicyDocument: inlinePolicy.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async attachManagedPolicies(userProperties) {
+    async attachManagedPolicies(userProperties, options) {
         await Promise.all(userProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyArn: policyArn,
             },
-        })));
+        }, options)));
     }
     /**
      * Give the User a console password, the way real CloudFormation calls
      * CreateLoginProfile for a `LoginProfile` property.
      */
-    async createLoginProfile(userProperties) {
+    async createLoginProfile(userProperties, options) {
         const { loginProfile } = userProperties;
         if (loginProfile === undefined) {
             return;
@@ -61,6 +61,6 @@ export class SimCfnIamUserCreator {
                 Password: loginProfile.password,
                 PasswordResetRequired: loginProfile.passwordResetRequired,
             },
-        });
+        }, options);
     }
 }

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserDeleterProperties {
     readonly iam: SimIam;
 }
@@ -12,7 +13,8 @@ interface SimCfnIamUserDeleterProperties {
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export declare class SimCfnIamUserDeleter {
     private readonly iam;
@@ -20,6 +22,6 @@ export declare class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    delete(resource: SimCfnResource): Promise<void>;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.js

@@ -8,7 +8,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export class SimCfnIamUserDeleter {
     iam;
@@ -18,11 +19,24 @@ export class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    async delete(resource) {
+    async delete(resource, options) {
         const user = resource.simResource;
         assertDefined(user, `sim IAM User for CloudFormation Resource ${resource.logicalId}`);
+        const attachedPolicyArns = [...user.attachedPolicyArns];
+        const inlinePolicies = [...user.inlinePolicies];
         user.attachedPolicyArns.clear();
         user.inlinePolicies.clear();
-        await this.iam.deleteUser({ input: { UserName: user.userName } });
+        try {
+            await this.iam.deleteUser({ input: { UserName: user.userName } }, options);
+        }
+        catch (error) {
+            for (const policyArn of attachedPolicyArns) {
+                user.attachedPolicyArns.add(policyArn);
+            }
+            for (const [policyName, document] of inlinePolicies) {
+                user.inlinePolicies.set(policyName, document);
+            }
+            throw error;
+        }
     }
 }

package/dist/service/iam/command/sim-iam-command-handlers.js

@@ -1,4 +1,5 @@
 import { SimIamActionAuthorizer } from "../authorize/sim-iam-action-authorizer.js";
+import { simIamGlobalServiceRegion, simIamInRegion, } from "../authorize/sim-iam-region-auth-z.js";
 import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
 import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
 import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
@@ -15,7 +16,11 @@ export class SimIamCommandHandlers {
     users;
     policies;
     constructor(properties) {
-        const authorizer = new SimIamActionAuthorizer({ iam: properties.iam });
+        // IAM is global rather than Region-scoped, so its own control-plane
+        // requests are made in the Region its one endpoint is in.
+        const authorizer = new SimIamActionAuthorizer({
+            iam: simIamInRegion(properties.iam, simIamGlobalServiceRegion),
+        });
         this.roles = new SimIamRoleCommandHandlers({
             accountId: properties.accountId,
             roles: properties.roles,

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKinesis } from "../sim-kinesis.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisResourceDeleterProperties {
     readonly kinesis: SimKinesis;
 }
@@ -12,6 +13,6 @@ export declare class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.js

@@ -10,12 +10,12 @@ export class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const stream = resource.simResource;
         assertDefined(stream, `sim Kinesis stream for CloudFormation Resource ${resource.logicalId}`);
-        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } });
+        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } }, options);
     }
 }

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.d.ts

@@ -25,6 +25,6 @@ export declare class SimKinesisCfnResourceFactory implements SimCfnServiceResour
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.js

@@ -1,5 +1,6 @@
 import { SimCfnKinesisResourceDeleter } from "./sim-cfn-kinesis-resource-deleter.js";
 import { SimCfnKinesisStreamCreator } from "./stream/sim-cfn-kinesis-stream-creator.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Kinesis resources.
  */
@@ -27,12 +28,12 @@ export class SimKinesisCfnResourceFactory {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKinesis } from "../../sim-kinesis.js";
 import type { SimKinesisStream } from "../../stream/sim-kinesis-stream.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisStreamCreatorProperties {
     readonly kinesis: SimKinesis;
 }
@@ -23,7 +24,7 @@ export declare class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKinesisStream>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKinesisStream>;
     /**
      * Move the stream's retention up to what the template asked for.
      *

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.js

@@ -23,7 +23,7 @@ export class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const streamProperties = new SimCfnKinesisStreamProperties({
             resource,
             properties,
@@ -43,8 +43,8 @@ export class SimCfnKinesisStreamCreator {
                     }),
                     ...(tags !== undefined && { Tags: tags }),
                 },
-            });
-            await this.applyRetention(name, retentionHours);
+            }, options);
+            await this.applyRetention(name, retentionHours, options);
             const stream = this.kinesis.findStream(name);
             assertDefined(stream, `sim Kinesis stream ${name} after CloudFormation creation`);
             return stream;
@@ -59,13 +59,11 @@ export class SimCfnKinesisStreamCreator {
      * which is just as well: real Kinesis refuses an increase to what the stream
      * already keeps.
      */
-    async applyRetention(name, retentionHours) {
+    async applyRetention(name, retentionHours, options) {
         if (retentionHours === undefined ||
             retentionHours <= simKinesisDefaultRetentionHours) {
             return;
         }
-        await this.kinesis.increaseStreamRetentionPeriod({
-            input: { StreamName: name, RetentionPeriodHours: retentionHours },
-        });
+        await this.kinesis.increaseStreamRetentionPeriod({ input: { StreamName: name, RetentionPeriodHours: retentionHours } }, options);
     }
 }

package/dist/service/kinesis/sim-kinesis.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simKinesisCommands from "./command/sim-kinesis-command.types.js";
 import type { SimKinesisRequestOptions } from "./command/sim-kinesis-request-options.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";

package/dist/service/kinesis/sim-kinesis.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKinesisCommands } from "./command/sim-kinesis-commands.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";
 import { SimKinesisSdkCommandRouter } from "./sdk/sim-kinesis-sdk-command-router.js";
@@ -32,7 +32,8 @@ export class SimKinesis {
         kinesis: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimKinesisCommands({
             streams: this.streams,

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsAlias } from "../../key/sim-kms-alias.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsAliasCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,6 +20,6 @@ export declare class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsAlias>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsAlias>;
 }
 export {};

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const aliasProperties = new SimCfnKmsAliasProperties({
             resource,
             properties,
@@ -27,7 +27,7 @@ export class SimCfnKmsAliasCreator {
                 AliasName: aliasName,
                 TargetKeyId: aliasProperties.targetKeyId(),
             },
-        });
+        }, options);
         const alias = this.kms.findAlias(aliasName);
         assertDefined(alias, `sim KMS alias ${aliasName} after CloudFormation creation`);
         return alias;

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsKey } from "../../key/sim-kms-key.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsKeyCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,16 +20,15 @@ export declare class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsKey>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsKey>;
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
     private applyEnabled;
 }

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const keyProperties = new SimCfnKmsKeyProperties({ resource, properties });
         const created = await this.kms.createKey({
             input: {
@@ -26,27 +26,27 @@ export class SimCfnKmsKeyCreator {
                 KeyUsage: keyProperties.keyUsage(),
                 Origin: keyProperties.origin(),
             },
-        });
+        }, options);
         const keyId = created.KeyMetadata?.KeyId;
         assertDefined(keyId, `sim KMS key ID after CloudFormation creation for ${resource.logicalId}`);
         const key = this.kms.findKey(keyId);
         assertDefined(key, `sim KMS key ${keyId} after CloudFormation creation`);
-        this.applyEnabled(key, keyProperties.enabled());
+        await this.applyEnabled(keyId, keyProperties.enabled(), options);
         return key;
     }
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
-    applyEnabled(key, enabled) {
-        if (!enabled) {
-            key.disable();
+    async applyEnabled(keyId, enabled, options) {
+        if (enabled) {
+            return;
         }
+        await this.kms.disableKey({ input: { KeyId: keyId } }, options);
     }
 }

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsResourceDeleterProperties {
     readonly kms: SimKms;
 }
@@ -17,6 +18,6 @@ export declare class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.js

@@ -15,20 +15,18 @@ export class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         switch (resourceTypeName) {
             case "Key": {
                 const key = resource.simResource;
                 assertDefined(key, `sim KMS Key for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } });
+                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } }, options);
                 return;
             }
             case "Alias": {
                 const alias = resource.simResource;
                 assertDefined(alias, `sim KMS Alias for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.deleteAlias({
-                    input: { AliasName: alias.aliasName },
-                });
+                await this.kms.deleteAlias({ input: { AliasName: alias.aliasName } }, options);
                 return;
             }
             default: {

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.type.js";
 interface SimKmsCfnResourceFactoryProperties {
     readonly kms: SimKms;
 }
@@ -22,6 +23,6 @@ export declare class SimKmsCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnKmsAliasCreator } from "./alias/sim-cfn-kms-alias-creator.js";
 import { SimCfnKmsKeyCreator } from "./key/sim-cfn-kms-key-creator.js";
 import { SimCfnKmsResourceDeleter } from "./sim-cfn-kms-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated KMS resources.
  */
@@ -21,12 +22,13 @@ export class SimKmsCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "Key": {
-                return await this.keyCreator.create(resource, properties);
+                return await this.keyCreator.create(resource, properties, options);
             }
             case "Alias": {
-                return await this.aliasCreator.create(resource, properties);
+                return await this.aliasCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim KMS CloudFormation Resource ${resourceTypeName}`);
@@ -36,7 +38,7 @@ export class SimKmsCfnResourceFactory {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }