@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/stepfunctions/cfn/sim-cfn-step-functions-resource-deleter.js

@@ -13,15 +13,13 @@ export class SimCfnStepFunctionsResourceDeleter {
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== stateMachineResourceTypeName) {
             throw new Error(`Unsupported sim StepFunctions CloudFormation Resource ` +
                 `${resourceTypeName} deletion`);
         }
         const stateMachine = resource.simResource;
         assertDefined(stateMachine, `sim state machine for CloudFormation Resource ${resource.logicalId}`);
-        await this.#stepFunctions.deleteStateMachine({
-            input: { stateMachineArn: stateMachine.arn },
-        });
+        await this.#stepFunctions.deleteStateMachine({ input: { stateMachineArn: stateMachine.arn } }, options);
     }
 }

package/dist/service/stepfunctions/cfn/sim-step-functions-cfn-resource-factory.d.ts

@@ -28,6 +28,6 @@ export declare class SimStepFunctionsCfnResourceFactory implements SimCfnService
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/stepfunctions/cfn/sim-step-functions-cfn-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnStateMachineCreator } from "./state-machine/sim-cfn-state-machine-creator.js";
 import { SimCfnStepFunctionsResourceDeleter } from "./sim-cfn-step-functions-resource-deleter.js";
 import { stateMachineResourceTypeName } from "./sim-cfn-step-functions-resource-types.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Step Functions resources.
  */
@@ -30,13 +31,13 @@ export class SimStepFunctionsCfnResourceFactory {
         if (resourceTypeName !== stateMachineResourceTypeName) {
             throw new Error(`Unsupported sim StepFunctions CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.#stateMachineCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.#stateMachineCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.#deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.#deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/stepfunctions/cfn/state-machine/sim-cfn-state-machine-creator.d.ts

@@ -3,6 +3,7 @@ import type { SimStatesDefinitionStore } from "../../definition/store/sim-states
 import type { SimStepFunctions } from "../../sim-step-functions.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnStateMachineCreatorProperties {
     readonly stepFunctions: SimStepFunctions;
     /** Where a `DefinitionS3Location` is read from. */
@@ -24,6 +25,6 @@ export declare class SimCfnStateMachineCreator {
     /**
      * Create a state machine from an AWS::StepFunctions::StateMachine Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimStateMachine>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimStateMachine>;
 }
 export {};

package/dist/service/stepfunctions/cfn/state-machine/sim-cfn-state-machine-creator.js

@@ -22,7 +22,7 @@ export class SimCfnStateMachineCreator {
     /**
      * Create a state machine from an AWS::StepFunctions::StateMachine Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const stateMachineProperties = new SimCfnStateMachineProperties({
             resource,
             properties,
@@ -42,7 +42,7 @@ export class SimCfnStateMachineCreator {
                     tags,
                     ...(type !== undefined && { type }),
                 },
-            });
+            }, options);
             const stateMachine = this.#stepFunctions.findStateMachine(name);
             assertDefined(stateMachine, `sim state machine ${name} after CloudFormation creation`);
             return stateMachine;

package/dist/service/stepfunctions/task/sim-aws-states-task-targets.js

@@ -29,10 +29,8 @@ export class SimAwsStatesTaskTargets {
     async invoke(invocation) {
         const { stateName, target } = invocation;
         const role = simStatesExecutionRoleTarget(invocation.roleArn, stateName);
-        const iam = this.#simAws
-            .accountRegionScope(role.accountId, this.#accountRegionScope.regionName)
-            .iam();
-        const caller = await assumeSimStatesExecutionRole(role, iam);
+        const roleScope = this.#simAws.accountRegionScope(role.accountId, this.#accountRegionScope.regionName);
+        const caller = await assumeSimStatesExecutionRole(role, roleScope);
         return await target.run({
             stateName,
             payload: invocation.payload,

package/dist/service/stepfunctions/task/sim-states-execution-role.d.ts

@@ -1,6 +1,6 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
-import type { SimIam } from "../../iam/sim-iam.js";
-import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role.js";
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
 /**
  * The service principal a state machine's execution role trusts.
  */
@@ -21,4 +21,4 @@ export declare function simStatesExecutionRoleTarget(roleArn: string, stateName:
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, iam: SimIam): Promise<SimAwsCaller>;
+export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer): Promise<SimAwsCaller>;

package/dist/service/stepfunctions/task/sim-states-execution-role.js

@@ -1,4 +1,5 @@
-import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { assumeSimServiceRole, } from "../../sts/service-role/sim-service-role.js";
+import { simServiceRoleTarget, } from "../../sts/service-role/sim-service-role-target.js";
 import { SimStatesTaskFailure } from "../error/sim-step-functions.error.js";
 /**
  * The service principal a state machine's execution role trusts.
@@ -45,12 +46,12 @@ const refusals = {
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export async function assumeSimStatesExecutionRole(target, iam) {
+export async function assumeSimStatesExecutionRole(target, scope) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simStatesServicePrincipal,
         sessionName,
-        iam,
+        scope,
         refusals,
     });
 }

package/dist/service/stepfunctions/task/sim-states-task-function.js

@@ -1,4 +1,5 @@
 import { SimStatesTaskFailure } from "../error/sim-step-functions.error.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * The action an execution needs to invoke a function.
  */
@@ -40,7 +41,7 @@ export class SimStatesTaskFunction {
      * only its own identity policy.
      */
     authorize(request, functionArn) {
-        const decision = this.#scope.iam().authorize({
+        const decision = simScopeIamAuthZ(this.#scope).authorize({
             action: invokeAction,
             resource: functionArn,
             caller: request.caller,

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,5 +1,6 @@
 import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
@@ -7,6 +8,8 @@ import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser
 interface AssumeRoleAuthorizationCoordinatorProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /** The Region the STS request was made in. */
+    readonly regionName: AwsRegionName;
 }
 interface AssumeRoleAuthorizationInput {
     readonly roleArn: string;

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -20,13 +20,8 @@ export class AssumeRoleAuthorizationCoordinator {
     targetRoleAuthorizer;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
-        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer({
-            sourceAccountId: properties.sourceAccountId,
-            iamResolver: properties.iamResolver,
-        });
-        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer({
-            iamResolver: properties.iamResolver,
-        });
+        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer(properties);
+        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer(properties);
     }
     /**
      * Require the applicable source identity and target trust permissions.

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.d.ts

@@ -1,9 +1,14 @@
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleSourceAccountAuthorizerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The Region the STS request was made in.
+     */
+    readonly regionName: AwsRegionName;
 }
 export interface AssumeRoleSourceAuthorizationInput {
     readonly roleArn: string;
@@ -32,6 +37,7 @@ export interface AssumeRoleSourceAuthorizationInput {
 export declare class AssumeRoleSourcePrincipalAuthorizer {
     private readonly sourceAccountId;
     private readonly iamResolver;
+    private readonly regionName;
     constructor(properties: AssumeRoleSourceAccountAuthorizerProperties);
     /**
      * Require the source Account to allow the caller to assume the target role.

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.js

@@ -16,9 +16,11 @@ import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 export class AssumeRoleSourcePrincipalAuthorizer {
     sourceAccountId;
     iamResolver;
+    regionName;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
         this.iamResolver = properties.iamResolver;
+        this.regionName = properties.regionName;
     }
     /**
      * Require the source Account to allow the caller to assume the target role.
@@ -33,6 +35,7 @@ export class AssumeRoleSourcePrincipalAuthorizer {
         const decision = sourceIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
+            region: this.regionName,
             caller: callerPrincipal,
         });
         if (decision.isExplicitDeny ||

package/dist/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -1,5 +1,6 @@
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
@@ -7,6 +8,10 @@ import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import { type AssumeRoleTrustPolicyAuthorization } from "./assume-role-trust-policy-authorizer.js";
 interface AssumeRoleTargetRoleAuthorizerProperties {
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The Region the STS request was made in.
+     */
+    readonly regionName: AwsRegionName;
 }
 type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
 interface AssumeRoleTargetAuthorizationInput {
@@ -31,6 +36,7 @@ interface AssumeRoleTargetAuthorization {
  */
 export declare class AssumeRoleTargetRoleAuthorizer {
     private readonly iamResolver;
+    private readonly regionName;
     private readonly targetResolver;
     private readonly trustPolicyAuthorizer;
     constructor(properties: AssumeRoleTargetRoleAuthorizerProperties);

package/dist/service/sts/auth-z/assume-role-target-auth-z.js

@@ -12,10 +12,12 @@ import { AssumeRoleTrustPolicyAuthorizer, } from "./assume-role-trust-policy-aut
  */
 export class AssumeRoleTargetRoleAuthorizer {
     iamResolver;
+    regionName;
     targetResolver = new AssumeRoleTargetResolver();
     trustPolicyAuthorizer = new AssumeRoleTrustPolicyAuthorizer();
     constructor(properties) {
         this.iamResolver = properties.iamResolver;
+        this.regionName = properties.regionName;
     }
     /**
      * Resolve the requested Role, load it from the target account, and require its
@@ -38,6 +40,7 @@ export class AssumeRoleTargetRoleAuthorizer {
             roleArn: input.roleArn,
             role,
             targetIam,
+            region: this.regionName,
             caller: input.caller,
             conditionContext: input.conditionContext,
         });

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -1,4 +1,5 @@
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import type { SimIam } from "../../iam/sim-iam.js";
@@ -8,6 +9,11 @@ interface AssumeRoleTrustPolicyAuthorizationInput {
     readonly roleArn: string;
     readonly role: AssumeRoleTargetRole;
     readonly targetIam: SimIam;
+    /**
+     * The Region the assume request was made in, which the trust policy and the
+     * target Account's service control policies can be conditioned on.
+     */
+    readonly region?: AwsRegionName | undefined;
     readonly caller: SimAwsPrincipal;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -37,6 +37,7 @@ export class AssumeRoleTrustPolicyAuthorizer {
         const decision = input.targetIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
+            region: input.region,
             caller: input.caller,
             conditionContext: input.conditionContext,
             resourcePolicies: [

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -3,9 +3,14 @@ import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-accoun
 import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-role.command.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
+    /**
+     * The Region this STS is in, which is the Region its requests are made in.
+     */
+    readonly regionName: AwsRegionName;
     readonly iamResolver: SimIamAccountResolver;
     readonly background?: BackgroundScheduler;
 }

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -22,12 +22,13 @@ export class AssumeRoleCommandHandler {
     sessionCreator;
     sourceAccountId;
     constructor(properties) {
-        const { sourceAccountId, iamResolver, background = new BackgroundTasks(), } = properties;
+        const { sourceAccountId, regionName, iamResolver, background = new BackgroundTasks(), } = properties;
         this.sourceAccountId = sourceAccountId;
         this.background = background;
         this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
             sourceAccountId,
             iamResolver,
+            regionName,
         });
         this.sessionCreator = new SimStsAssumeRoleSessionCreator({
             iamResolver,

package/dist/service/sts/service-role/sim-service-role-source.d.ts

@@ -0,0 +1,33 @@
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * The resource a service says it is assuming a role for, as `aws:SourceArn`.
+ */
+export declare const simServiceRoleSourceArnConditionKey = "aws:SourceArn";
+/**
+ * The Account owning that resource, as `aws:SourceAccount`.
+ */
+export declare const simServiceRoleSourceAccountConditionKey = "aws:SourceAccount";
+/**
+ * Which of its own resources a service is assuming a role on behalf of.
+ *
+ * AWS recommends conditioning a service role's trust policy on these two
+ * against the confused deputy problem, so that a role trusting
+ * `scheduler.amazonaws.com` is assumable for one schedule group rather than by
+ * Scheduler at large. Which resource counts is the service's own answer, and
+ * differs between services: Scheduler names a schedule group and EventBridge
+ * names a rule.
+ */
+export interface SimServiceRoleSource {
+    readonly arn: string;
+    readonly accountId: string;
+}
+/**
+ * The request-time values a trust policy statement's conditions are matched
+ * against.
+ *
+ * A service that states no source supplies neither key, so a trust policy
+ * conditioned on either fails to match instead of matching an empty string.
+ * That is the safe direction. A role scoped to one schedule group should refuse
+ * an assume request that says nothing about which group it is for.
+ */
+export declare function simServiceRoleConditionContext(source: SimServiceRoleSource | undefined): Readonly<Record<string, SimIamConditionValue>>;

package/dist/service/sts/service-role/sim-service-role-source.js

@@ -0,0 +1,26 @@
+/**
+ * The resource a service says it is assuming a role for, as `aws:SourceArn`.
+ */
+export const simServiceRoleSourceArnConditionKey = "aws:SourceArn";
+/**
+ * The Account owning that resource, as `aws:SourceAccount`.
+ */
+export const simServiceRoleSourceAccountConditionKey = "aws:SourceAccount";
+/**
+ * The request-time values a trust policy statement's conditions are matched
+ * against.
+ *
+ * A service that states no source supplies neither key, so a trust policy
+ * conditioned on either fails to match instead of matching an empty string.
+ * That is the safe direction. A role scoped to one schedule group should refuse
+ * an assume request that says nothing about which group it is for.
+ */
+export function simServiceRoleConditionContext(source) {
+    if (source === undefined) {
+        return {};
+    }
+    return {
+        [simServiceRoleSourceArnConditionKey]: source.arn,
+        [simServiceRoleSourceAccountConditionKey]: source.accountId,
+    };
+}

package/dist/service/sts/service-role/sim-service-role-target.d.ts

@@ -0,0 +1,26 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Which IAM a role ARN belongs to, and what the role is called there.
+ */
+export interface SimServiceRoleTarget {
+    readonly accountId: SimAwsAccountId;
+    readonly roleName: string;
+    readonly roleArn: string;
+}
+/**
+ * Read the Account and name out of a role ARN a service will assume.
+ *
+ * The ARN is checked for being a role ARN where the request that carried it was
+ * written, so this is reading a known shape rather than validating an unknown
+ * one.
+ */
+export declare function simServiceRoleTarget(roleArn: string): SimServiceRoleTarget;
+/**
+ * The caller one assumed service-role session makes.
+ *
+ * It carries both principals. The request is attributed to the session, as it
+ * is on AWS, while the policies that apply are the role's. That is exactly the
+ * split `SimResolvedCaller` exists for.
+ */
+export declare function simServiceRoleCaller(target: SimServiceRoleTarget, sessionName: string): SimAwsCaller;

package/dist/service/sts/service-role/sim-service-role-target.js

@@ -0,0 +1,27 @@
+import { IamRoleArnParser } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+/**
+ * Read the Account and name out of a role ARN a service will assume.
+ *
+ * The ARN is checked for being a role ARN where the request that carried it was
+ * written, so this is reading a known shape rather than validating an unknown
+ * one.
+ */
+export function simServiceRoleTarget(roleArn) {
+    const parts = new IamRoleArnParser().parse(roleArn);
+    return { accountId: parts.accountId, roleName: parts.roleName, roleArn };
+}
+/**
+ * The caller one assumed service-role session makes.
+ *
+ * It carries both principals. The request is attributed to the session, as it
+ * is on AWS, while the policies that apply are the role's. That is exactly the
+ * split `SimResolvedCaller` exists for.
+ */
+export function simServiceRoleCaller(target, sessionName) {
+    const session = `arn:aws:sts::${target.accountId}:assumed-role/${target.roleName}/${sessionName}`;
+    return {
+        kind: "resolved",
+        principal: { kind: "arn", arn: session },
+        identityPolicyPrincipal: { kind: "arn", arn: target.roleArn },
+    };
+}

package/dist/service/sts/service-role/sim-service-role.d.ts

@@ -1,14 +1,7 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
-import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimIam } from "../../iam/sim-iam.js";
-/**
- * Which IAM a role ARN belongs to, and what the role is called there.
- */
-export interface SimServiceRoleTarget {
-    readonly accountId: SimAwsAccountId;
-    readonly roleName: string;
-    readonly roleArn: string;
-}
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimServiceRoleSource } from "./sim-service-role-source.js";
+import { type SimServiceRoleTarget } from "./sim-service-role-target.js";
 /**
  * How a service says that it could not assume a role, in its own words.
  *
@@ -38,19 +31,22 @@ export interface SimServiceRoleAssumption {
      */
     readonly sessionName: string;
     /**
-     * The IAM of the role's own Account, which is not always the target's.
+     * The Account and Region scope the role is assumed in.
+     *
+     * Its IAM is the role's own Account's, which is not always the target's, and
+     * its Region is the one the assume request is made in.
+     */
+    readonly scope: SimAwsAccountRegionContainer;
+    /**
+     * Which of the service's own resources the role is assumed for.
+     *
+     * A service that states one has its trust policy evaluated with
+     * `aws:SourceArn` and `aws:SourceAccount` in hand, which is what a role
+     * carrying AWS's confused deputy condition needs to be assumable at all.
      */
-    readonly iam: SimIam;
+    readonly source?: SimServiceRoleSource | undefined;
     readonly refusals: SimServiceRoleRefusals;
 }
-/**
- * Read the Account and name out of a role ARN a service will assume.
- *
- * The ARN is checked for being a role ARN where the request that carried it was
- * written, so this is reading a known shape rather than validating an unknown
- * one.
- */
-export declare function simServiceRoleTarget(roleArn: string): SimServiceRoleTarget;
 /**
  * Assume a role as a service principal, and answer with the caller it makes.
  *

package/dist/service/sts/service-role/sim-service-role.js

@@ -1,17 +1,7 @@
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
-import { IamRoleArnParser } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
 import { AssumeRoleTrustPolicyAuthorizer } from "../auth-z/assume-role-trust-policy-authorizer.js";
-/**
- * Read the Account and name out of a role ARN a service will assume.
- *
- * The ARN is checked for being a role ARN where the request that carried it was
- * written, so this is reading a known shape rather than validating an unknown
- * one.
- */
-export function simServiceRoleTarget(roleArn) {
-    const parts = new IamRoleArnParser().parse(roleArn);
-    return { accountId: parts.accountId, roleName: parts.roleName, roleArn };
-}
+import { simServiceRoleConditionContext, } from "./sim-service-role-source.js";
+import { simServiceRoleCaller, } from "./sim-service-role-target.js";
 /**
  * Assume a role as a service principal, and answer with the caller it makes.
  *
@@ -26,14 +16,17 @@ export function simServiceRoleTarget(roleArn) {
  * exactly the split `SimResolvedCaller` exists for.
  */
 export async function assumeSimServiceRole(assumption) {
-    const { target, servicePrincipal, sessionName, iam, refusals } = assumption;
+    const { target, servicePrincipal, sessionName, scope, source, refusals } = assumption;
+    const iam = scope.iam();
     const role = await roleOrRefuse(target, iam, refusals);
     try {
         new AssumeRoleTrustPolicyAuthorizer().authorize({
             roleArn: target.roleArn,
             role,
             targetIam: iam,
+            region: scope.accountRegionScope.regionName,
             caller: { kind: "service", service: servicePrincipal },
+            conditionContext: simServiceRoleConditionContext(source),
         });
     }
     catch (error) {
@@ -42,14 +35,7 @@ export async function assumeSimServiceRole(assumption) {
         }
         throw error;
     }
-    return {
-        kind: "resolved",
-        principal: {
-            kind: "arn",
-            arn: `arn:aws:sts::${target.accountId}:assumed-role/${target.roleName}/${sessionName}`,
-        },
-        identityPolicyPrincipal: { kind: "arn", arn: target.roleArn },
-    };
+    return simServiceRoleCaller(target, sessionName);
 }
 /**
  * Load the role, refusing when it is not there.

package/dist/service/sts/sim-sts.js

@@ -28,6 +28,7 @@ export class SimSts {
     async assumeRole(command, options) {
         const handler = new AssumeRoleCommandHandler({
             sourceAccountId: this.accountRegionScope.accountId,
+            regionName: this.accountRegionScope.regionName,
             iamResolver: this.iamResolver,
             background: this.background,
         });

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimWafV2 } from "../../sim-wafv2.js";
 import { SimWafCfnWebAclAssociation } from "./sim-cfn-waf-web-acl-association.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnWafAssociationCreatorProperties {
     readonly wafV2: SimWafV2;
 }
@@ -26,7 +27,7 @@ export declare class SimCfnWafAssociationCreator {
     /**
      * Make the association an AWS::WAFv2::WebACLAssociation Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimWafCfnWebAclAssociation>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimWafCfnWebAclAssociation>;
     /**
      * Take the association an AWS::WAFv2::WebACLAssociation Resource made off
      * again.
@@ -40,6 +41,6 @@ export declare class SimCfnWafAssociationCreator {
      * CloudFormation no reason to bring the association down first, and deleting
      * the stage took the association with it, so there is nothing left to undo.
      */
-    delete(resource: SimCfnResource, association: SimWafCfnWebAclAssociation): Promise<void>;
+    delete(resource: SimCfnResource, association: SimWafCfnWebAclAssociation, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js

@@ -27,7 +27,7 @@ export class SimCfnWafAssociationCreator {
     /**
      * Make the association an AWS::WAFv2::WebACLAssociation Resource describes.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const config = new SimCfnWafAssociationConfig({ resource, properties });
         const association = new SimWafCfnWebAclAssociation({
             resourceArn: config.resourceArn(),
@@ -43,7 +43,7 @@ export class SimCfnWafAssociationCreator {
                     ResourceArn: association.resourceArn,
                     WebACLArn: association.webAclArn,
                 },
-            });
+            }, options);
             return association;
         });
     }
@@ -60,12 +60,10 @@ export class SimCfnWafAssociationCreator {
      * CloudFormation no reason to bring the association down first, and deleting
      * the stage took the association with it, so there is nothing left to undo.
      */
-    async delete(resource, association) {
+    async delete(resource, association, options) {
         await simCfnWafResourceCommand(wafWebAclAssociationResourceType, resource.logicalId, async () => {
             try {
-                await this.#wafV2.disassociateWebAcl({
-                    input: { ResourceArn: association.resourceArn },
-                });
+                await this.#wafV2.disassociateWebAcl({ input: { ResourceArn: association.resourceArn } }, options);
             }
             catch (error) {
                 if (!(error instanceof SimWafUnavailableEntityException)) {