@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -1,4 +1,5 @@
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
 export interface SimCloudFormationDeployCdkOutProperties {
@@ -17,8 +18,13 @@ export interface SimCloudFormationDeployCdkOutProperties {
      */
     readonly stackNames?: readonly string[] | undefined;
     /**
-     * Bindings, parameters and a transform for individual Stacks, keyed the same
-     * way `stackNames` names them.
+     * The principal every Stack in the assembly is deployed as, which one named
+     * in `stackOptions` overrides for its own Stack.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Bindings, parameters, a caller and a transform for individual Stacks,
+     * keyed the same way `stackNames` names them.
      */
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
@@ -28,6 +34,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 }
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
+    readonly caller?: SimAwsCaller | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, stackOptions } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -22,6 +22,7 @@ export async function planCdkOutDeployment(properties) {
             ...stack,
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
+        caller,
         stackOptions,
     };
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -1,5 +1,6 @@
 import type { SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDeployedStack } from "../stack/sim-cfn-deployed-stack.type.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import type { SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
@@ -26,6 +27,12 @@ export type SimCfnCdkOutTemplateTransform = (template: CfnTemplateBodyRecord, de
 export interface SimCfnCdkOutStackOptions {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal this Stack is deployed as, where the assembly's own caller
+     * is not the right one for it. A pipeline Stack deployed by one role and an
+     * application Stack deployed by another is what this is for.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     readonly transform?: SimCfnCdkOutTemplateTransform | undefined;
 }
 export type SimCfnCdkOutStackOptionsByName = Record<string, SimCfnCdkOutStackOptions>;
@@ -43,8 +50,8 @@ export declare function cdkOutBoundTransform(transform: SimCfnCdkOutTemplateTran
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.js

@@ -20,17 +20,14 @@ export function cdkOutBoundTransform(transform, deployed) {
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
     const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
     const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
     if (unmatched.length > 0) {
-        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${stackNames(deploying)}.`);
+        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
     }
 }
-function stackNames(stacks) {
-    return stacks.map((stack) => stack.stackName).join(", ");
-}

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -5,6 +5,7 @@ import { type SimCloudFormationDeployTemplateFileProperties as SimCloudFormation
 import { type SimCloudFormationDeployCdkOutProperties } from "./sim-cfn-cdk-out-deployer.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
@@ -13,6 +14,15 @@ export interface SimCloudFormationCreateStackProperties {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * The synthesized CDK template file this in-memory template stands in for.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -58,6 +58,7 @@ export class SimCloudFormationTemplateDeployer {
             template: properties.template,
             parameters: properties.parameters,
             bindings: properties.bindings,
+            caller: properties.caller,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
     }
@@ -110,13 +111,13 @@ export class SimCloudFormationTemplateDeployer {
                     ParameterValue: parameterValue,
                 })),
             },
-        }, properties.cdkOutContext, properties.bindings);
+        }, properties.cdkOutContext, properties.bindings, properties.caller);
         const stack = this.stacks.get(properties.stackName);
         assertDefined(stack, `Sim CloudFormation Stack named ${properties.stackName}`);
         await stack.waitForDeployComplete();
         return stack;
     }
-    async createStackWithContext(command, cdkOutContext, bindings) {
+    async createStackWithContext(command, cdkOutContext, bindings, caller) {
         const handler = new CreateStackCommandHandler({
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
@@ -124,6 +125,7 @@ export class SimCloudFormationTemplateDeployer {
             background: this.background,
             cdkOutContext,
             bindings,
+            caller,
             exports: this.exports,
         });
         return await handler.handle(command);

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -2,6 +2,7 @@ import type { SimCloudFormationStackName } from "../stack/sim-cfn-stack.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import { type SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnTemplateFileWatchOptions } from "../watch/sim-cfn-template-watch.type.js";
 import { type SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
 export interface SimCloudFormationDeployTemplateFileProperties {
@@ -9,6 +10,15 @@ export interface SimCloudFormationDeployTemplateFileProperties {
     readonly stackName?: SimCloudFormationStackName | string | undefined;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * Adapt the parsed template before it is deployed, and again every time a
      * watched file changes.
@@ -42,6 +52,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings } = deployment;
+        const { templatePath, parameters, bindings, caller } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -31,6 +31,7 @@ export class SimCfnTemplateFileLoader {
             template,
             parameters,
             bindings,
+            caller,
             cdkOutContext,
         };
     }

package/dist/service/cloudformation/deploy/sim-cfn-template-file-updater.js

@@ -42,6 +42,7 @@ export class SimCfnTemplateFileUpdater {
             stacks: this.stacks,
             background: this.background,
             cdkOutContext: loaded.cdkOutContext,
+            caller: loaded.caller,
         });
         await handler.handle({
             input: {

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.d.ts

@@ -0,0 +1,16 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+/**
+ * The request options a Resource operation makes its service calls with.
+ *
+ * Every simulated service takes a caller the same way, so one shape carries the
+ * deployment's principal from the Stack down to the commands that create and
+ * delete Resources. Absent where the deployment named no caller, which leaves
+ * each service to its own default of the Account root.
+ */
+export type SimCfnResourceCallerOptions = {
+    readonly caller: SimAwsCaller;
+} | undefined;
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export declare function simCfnResourceCallerOptions(caller: SimAwsCaller | undefined): SimCfnResourceCallerOptions;

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.js

@@ -0,0 +1,6 @@
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export function simCfnResourceCallerOptions(caller) {
+    return caller === undefined ? undefined : { caller };
+}

package/dist/service/cloudformation/resource/cfn/scheduler/sim-scheduler-cfn-value-adapter.js

@@ -1,3 +1,4 @@
+import { SimSchedulerScheduleGroup } from "../../../../scheduler/group/sim-scheduler-schedule-group.js";
 import { SimSchedulerSchedule } from "../../../../scheduler/schedule/sim-scheduler-schedule.js";
 /**
  * CloudFormation-facing values for a simulated schedule.
@@ -23,6 +24,51 @@ class SimSchedulerScheduleCfn {
         throw new Error(`Unsupported AWS::Scheduler::Schedule attribute ${attributeName}`);
     }
 }
+/**
+ * CloudFormation-facing values for a simulated schedule group.
+ *
+ * `Arn` is the one worth having. An identity policy granting `scheduler:`
+ * actions on the group names it, and so does the `aws:SourceArn` condition AWS
+ * recommends in a schedule execution role's trust policy.
+ */
+class SimSchedulerScheduleGroupCfn {
+    group;
+    constructor(properties) {
+        this.group = properties.group;
+    }
+    /**
+     * AWS::Scheduler::ScheduleGroup Ref returns the group's name.
+     */
+    refValue() {
+        return this.group.name;
+    }
+    /**
+     * AWS::Scheduler::ScheduleGroup attributes.
+     *
+     * The two dates come back as ISO strings. A template value is JSON, so there
+     * is nowhere for a `Date` to go, and every other date CloudFormation hands
+     * back is a string too.
+     */
+    attributeValue(attributeName) {
+        switch (attributeName) {
+            case "Arn": {
+                return this.group.arn;
+            }
+            case "State": {
+                return this.group.state;
+            }
+            case "CreationDate": {
+                return this.group.creationDate.toISOString();
+            }
+            case "LastModificationDate": {
+                return this.group.lastModificationDate.toISOString();
+            }
+            default: {
+                throw new Error(`Unsupported AWS::Scheduler::ScheduleGroup attribute ${attributeName}`);
+            }
+        }
+    }
+}
 /**
  * The CloudFormation-facing value adapter for a simulated Scheduler Resource.
  */
@@ -31,5 +77,9 @@ export function schedulerValueAdapter(properties) {
         properties.simResource instanceof SimSchedulerSchedule) {
         return new SimSchedulerScheduleCfn({ schedule: properties.simResource });
     }
+    if (properties.type === "AWS::Scheduler::ScheduleGroup" &&
+        properties.simResource instanceof SimSchedulerScheduleGroup) {
+        return new SimSchedulerScheduleGroupCfn({ group: properties.simResource });
+    }
     return undefined;
 }

package/dist/service/cloudformation/resource/sim-cfn-resource.type.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnServiceResourceFactory } from "./factory/sim-cfn-resource-factory.type.js";
@@ -50,6 +51,15 @@ export interface SimCloudFormationResourceCreateContext {
     readonly resolvedProperties?: SimCfnTemplateValueRecord | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as, which every service command creating
+     * a Resource is authorized as.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default: the Account root, as it is everywhere else in
+     * the simulation.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * What a service is given to delete a Resource it created.
@@ -64,4 +74,6 @@ export interface SimCloudFormationResourceDeleteContext {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly resolvedProperties?: SimCfnTemplateValueRecord | undefined;
+    /** The principal the teardown runs as, as creation carries it. */
+    readonly caller?: SimAwsCaller | undefined;
 }

package/dist/service/cloudformation/sim-cloudformation.d.ts

@@ -12,7 +12,7 @@ import type { SimCloudFormationDeployTemplateFileProperties as SimCloudFormation
 import type { SimCloudFormationDeployCdkOutProperties } from "./deploy/sim-cfn-cdk-out-deployer.js";
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 /**
  * Options accepted by simulated CloudFormation command operations.
  */

package/dist/service/cloudformation/sim-cloudformation.js

@@ -8,7 +8,7 @@ import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-s
 import { SimCfnExports } from "./export/sim-cfn-exports.js";
 import { SimCloudFormationSdkCommandRouter } from "./sdk/sim-cloudformation-sdk-command-router.js";
 import { SimCloudFormationAuthorization } from "./authorize/sim-cloudformation-authorization.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * Simulated CloudFormation in one AWS Account and Region.
  */
@@ -22,7 +22,8 @@ export class SimCloudFormation {
     sdkRouter = new SimCloudFormationSdkCommandRouter(this);
     authorization;
     constructor(properties) {
-        const { simAws, accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background, } = properties;
+        const { simAws, accountRegionScope = simAwsAccountRegionScopeFactory.make(), background, } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.simAws = simAws;
         this.background = background;
         this.accountRegionScope = accountRegionScope;

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
@@ -7,6 +8,7 @@ interface SimCfnStackResourceBatchCreatorProperties {
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Creates one dependency-ready batch of Stack Resources.
@@ -27,6 +29,7 @@ export declare class SimCfnStackResourceBatchCreator {
     private readonly resources;
     private readonly cdkOutContext;
     private readonly bindings;
+    private readonly caller;
     constructor(properties: SimCfnStackResourceBatchCreatorProperties);
     /**
      * Create the supplied Resources concurrently.

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.js

@@ -17,12 +17,14 @@ export class SimCfnStackResourceBatchCreator {
     resources;
     cdkOutContext;
     bindings;
+    caller;
     constructor(properties) {
-        const { simAws, resources, cdkOutContext, bindings } = properties;
+        const { simAws, resources, cdkOutContext, bindings, caller } = properties;
         this.simAws = simAws;
         this.resources = resources;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
     }
     /**
      * Create the supplied Resources concurrently.
@@ -37,6 +39,7 @@ export class SimCfnStackResourceBatchCreator {
                 resources: this.resources,
                 cdkOutContext: this.cdkOutContext,
                 bindings: this.bindings,
+                caller: this.caller,
             });
         }));
     }

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
@@ -8,6 +9,7 @@ interface SimCfnStackResourceCreatorProperties {
     readonly stackName: string;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Orchestrates dependency-ordered creation of a Stack's simulated Resources.

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.js

@@ -21,7 +21,7 @@ export class SimCfnStackResourceCreator {
     stackName;
     batchCreator;
     constructor(properties) {
-        const { simAws, resources, stackName, cdkOutContext, bindings } = properties;
+        const { simAws, resources, stackName, cdkOutContext, bindings, caller } = properties;
         this.resources = resources;
         this.stackName = stackName;
         this.batchCreator = new SimCfnStackResourceBatchCreator({
@@ -29,6 +29,7 @@ export class SimCfnStackResourceCreator {
             resources,
             cdkOutContext,
             bindings,
+            caller,
         });
     }
     /**

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -1,5 +1,6 @@
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
@@ -19,6 +20,11 @@ interface SimCfnStackResourceOperationsProperties {
     readonly stackName: SimCloudFormationStackName;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the Stack's Resource work is authorized as. An omitted
+     * caller leaves each service to decide the request as the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * What a Stack can ask simulated AWS to do with its Resources.
@@ -39,16 +45,25 @@ export declare class SimCfnStackResourceOperations {
     private readonly stackName;
     private readonly bindings;
     private cdkOutContext;
+    private caller;
     constructor(properties: SimCfnStackResourceOperationsProperties);
     /**
-     * Read Resources from a different CDK cloud assembly from now on.
+     * Take on what an update brings with it, for this and every later operation.
      *
      * A synthesis writes the template and the assets manifest beside it together,
      * so a Stack updated from a re-synthesized template needs the manifest that
      * came with it. Keeping the one the Stack was deployed from would look up the
      * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
      */
-    useCdkOutContext(cdkOutContext: SimCdkOutContext): void;
+    useUpdate(properties: {
+        readonly cdkOutContext?: SimCdkOutContext | undefined;
+        readonly caller?: SimAwsCaller | undefined;
+    }): void;
     /**
      * Create every Resource in the given Stack Resource map.
      */

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -21,24 +21,32 @@ export class SimCfnStackResourceOperations {
     stackName;
     bindings;
     cdkOutContext;
+    caller;
     constructor(properties) {
-        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings } = properties;
+        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stackName = stackName;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
     }
     /**
-     * Read Resources from a different CDK cloud assembly from now on.
+     * Take on what an update brings with it, for this and every later operation.
      *
      * A synthesis writes the template and the assets manifest beside it together,
      * so a Stack updated from a re-synthesized template needs the manifest that
      * came with it. Keeping the one the Stack was deployed from would look up the
      * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
      */
-    useCdkOutContext(cdkOutContext) {
-        this.cdkOutContext = cdkOutContext;
+    useUpdate(properties) {
+        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
+        this.caller = properties.caller ?? this.caller;
     }
     /**
      * Create every Resource in the given Stack Resource map.
@@ -87,6 +95,7 @@ export class SimCfnStackResourceOperations {
             accountRegionScope: this.accountRegionScope,
             stackName: this.stackName,
             cdkOutContext: this.cdkOutContext,
+            caller: this.caller,
         }).publish();
     }
     creator(resources) {
@@ -96,6 +105,7 @@ export class SimCfnStackResourceOperations {
             stackName: this.stackName,
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
+            caller: this.caller,
         });
     }
     deleter(resources) {
@@ -103,6 +113,7 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
+            caller: this.caller,
         });
     }
 }

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -38,7 +38,7 @@ export class SimCfnStack {
     stackOutputs;
     cfnTemplate;
     constructor(properties) {
-        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, exports, } = properties;
+        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, caller, exports, } = properties;
         this.background = background;
         this.stackName = stackName;
         this.stackOutputs = new SimCfnStackOutputs({ stackName, exports });
@@ -60,6 +60,7 @@ export class SimCfnStack {
             stackName,
             cdkOutContext,
             bindings,
+            caller,
         });
         this.lifecycle = new SimCfnStackDeploymentLifecycle({
             background,
@@ -128,10 +129,9 @@ export class SimCfnStack {
         });
         updater.assertHasChanges();
         // Only once the update is going ahead, so a refused update leaves the Stack
-        // reading the cloud assembly it was deployed from.
-        if (properties.cdkOutContext !== undefined) {
-            this.operations.useCdkOutContext(properties.cdkOutContext);
-        }
+        // reading the cloud assembly it was deployed from and running as whoever
+        // deployed it.
+        this.operations.useUpdate(properties);
         this.cfnTemplate = template;
         this.template = template.template;
         await this.updating.update(async () => {

package/dist/service/cloudformation/stack/sim-cfn-stack.type.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { Brand } from "../../../util/brand.type.js";
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
@@ -16,6 +17,11 @@ export interface SimCfnStackUpdateProperties {
      * describes the assembly the previous template came from.
      */
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal to apply the new template as, for an update that names one.
+     * The Stack goes on using it, as it does the cloud assembly.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationStackProperties {
     readonly simAws: SimAws;
@@ -25,6 +31,12 @@ export interface SimCloudFormationStackProperties {
     readonly template: SimCfnTemplate;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal this Stack's Resources are created, updated and deleted as.
+     * An omitted caller is the Account root, as it is everywhere else in the
+     * simulation.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * The export names published in the Account and Region this Stack deploys
      * into. This Stack publishes its own Outputs here and reads the ones its

package/dist/service/cloudformation/stack/teardown/sim-cfn-stack-resource-batch-deleter.d.ts

@@ -1,8 +1,10 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 interface SimCfnStackResourceBatchDeleterProperties {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Deletes one batch of Stack Resources nothing still depends on.
@@ -17,6 +19,7 @@ interface SimCfnStackResourceBatchDeleterProperties {
 export declare class SimCfnStackResourceBatchDeleter {
     private readonly simAws;
     private readonly resources;
+    private readonly caller;
     constructor(properties: SimCfnStackResourceBatchDeleterProperties);
     /**
      * Delete the supplied Resources concurrently.