@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-creator.js

@@ -18,7 +18,7 @@ export class SimCfnEventBusCreator {
     /**
      * Create an event bus from an AWS::Events::EventBus Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const busProperties = new SimCfnEventBusProperties({
             resource,
             properties,
@@ -27,9 +27,7 @@ export class SimCfnEventBusCreator {
         const name = busProperties.name();
         const description = busProperties.description();
         return await simCfnEventBridgeResourceCreation(eventBusResourceType, resource.logicalId, async () => {
-            await this.eventBridge.createEventBus({
-                input: { Name: name, Description: description },
-            });
+            await this.eventBridge.createEventBus({ input: { Name: name, Description: description } }, options);
             const bus = this.eventBridge.findEventBus(name);
             assertDefined(bus, `sim EventBridge bus ${name} after CloudFormation creation`);
             return bus;

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEventRule } from "../../rule/sim-event-rule.js";
 import type { SimEventBridge } from "../../sim-event-bridge.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnEventRuleCreatorProperties {
     readonly eventBridge: SimEventBridge;
 }
@@ -23,7 +24,7 @@ export declare class SimCfnEventRuleCreator {
     /**
      * Create a rule, and its targets, from an AWS::Events::Rule Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimEventRule>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimEventRule>;
     /**
      * Add everything the rule's own `Targets` list declares.
      */

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.js

@@ -22,7 +22,7 @@ export class SimCfnEventRuleCreator {
     /**
      * Create a rule, and its targets, from an AWS::Events::Rule Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const ruleProperties = new SimCfnEventRuleProperties({
             resource,
             properties,
@@ -41,8 +41,8 @@ export class SimCfnEventRuleCreator {
                     State: ruleProperties.state(),
                     Description: ruleProperties.description(),
                 },
-            });
-            await this.putTargets(name, busName, targets);
+            }, options);
+            await this.putTargets(name, busName, targets, options);
             const rule = this.eventBridge.findRule(name, busName);
             assertDefined(rule, `sim EventBridge rule ${name} after CloudFormation creation`);
             return rule;
@@ -51,7 +51,7 @@ export class SimCfnEventRuleCreator {
     /**
      * Add everything the rule's own `Targets` list declares.
      */
-    async putTargets(ruleName, busName, targets) {
+    async putTargets(ruleName, busName, targets, options) {
         if (targets.length === 0) {
             return;
         }
@@ -65,6 +65,6 @@ export class SimCfnEventRuleCreator {
                     Input: target.Input,
                 })),
             },
-        });
+        }, options);
     }
 }

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-deleter.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimEventBridge } from "../sim-event-bridge.js";
 interface SimCfnEventBridgeResourceDeleterProperties {
@@ -18,7 +19,7 @@ export declare class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete one simulated EventBridge Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     /**
      * Delete the bus a Resource created, and the rules that hang off it.
      */

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-deleter.js

@@ -16,14 +16,14 @@ export class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete one simulated EventBridge Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "EventBus": {
-                await this.deleteBus(resource, properties);
+                await this.deleteBus(resource, properties, options);
                 return;
             }
             case "Rule": {
-                await this.deleteRule(resource, properties);
+                await this.deleteRule(resource, properties, options);
                 return;
             }
             default: {
@@ -34,17 +34,17 @@ export class SimCfnEventBridgeResourceDeleter {
     /**
      * Delete the bus a Resource created, and the rules that hang off it.
      */
-    async deleteBus(resource, properties) {
+    async deleteBus(resource, properties, options) {
         const name = new SimCfnEventBusProperties({
             resource,
             properties,
         }).name();
-        await this.eventBridge.deleteEventBus({ input: { Name: name } });
+        await this.eventBridge.deleteEventBus({ input: { Name: name } }, options);
     }
     /**
      * Delete the rule a Resource created, and its targets with it.
      */
-    async deleteRule(resource, properties) {
+    async deleteRule(resource, properties, options) {
         const ruleProperties = new SimCfnEventRuleProperties({
             resource,
             properties,
@@ -54,6 +54,6 @@ export class SimCfnEventBridgeResourceDeleter {
                 Name: ruleProperties.name(),
                 EventBusName: ruleProperties.busName(),
             },
-        });
+        }, options);
     }
 }

package/dist/service/eventbridge/cfn/sim-event-bridge-cfn-resource-factory.js

@@ -1,3 +1,4 @@
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnEventBusCreator } from "./bus/sim-cfn-event-bus-creator.js";
 import { SimCfnEventRuleCreator } from "./rule/sim-cfn-event-rule-creator.js";
 import { SimCfnEventBridgeResourceDeleter } from "./sim-cfn-event-bridge-resource-deleter.js";
@@ -28,12 +29,13 @@ export class SimEventBridgeCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "EventBus": {
-                return await this.busCreator.create(resource, properties);
+                return await this.busCreator.create(resource, properties, options);
             }
             case "Rule": {
-                return await this.ruleCreator.create(resource, properties);
+                return await this.ruleCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim EventBridge CloudFormation Resource ${resourceTypeName}`);
@@ -45,6 +47,6 @@ export class SimEventBridgeCfnResourceFactory {
      * Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-function.js

@@ -1,6 +1,7 @@
 import { SimLambdaServiceInvokeAuthorizer } from "../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryDocument, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A Lambda function a simulated rule is sending an event to, in the Account
  * and Region the target ARN names.
@@ -38,7 +39,7 @@ export class SimEventBridgeDeliveryFunction {
                     "or alias.");
         }
         const decision = new SimLambdaServiceInvokeAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             resource: target.resource,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-queue.js

@@ -1,6 +1,7 @@
 import { SimSqsServiceSendAuthorizer } from "../../sqs/command/authorize/sim-sqs-service-send-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryJson, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A queue a simulated rule is sending an event to, in the Account and Region
  * the target ARN names.
@@ -25,7 +26,7 @@ export class SimEventBridgeDeliveryQueue {
             throw new SimEventBridgeTargetNotFound(`${targetArn.value} is not a simulated SQS queue.`);
         }
         const decision = new SimSqsServiceSendAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             queue,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-task.js

@@ -24,7 +24,10 @@ export class SimEventBridgeDeliveryTask {
         const ecs = this.taskTarget(request);
         const role = eventBridgeTargetRole(ecs.roleArn);
         const roleScope = this.simAws.accountRegionScope(role.accountId, arn.regionName);
-        const caller = await assumeEventBridgeTargetRole(role, roleScope.iam());
+        const caller = await assumeEventBridgeTargetRole(role, roleScope, {
+            arn: request.ruleArn,
+            accountId: request.ruleOwnerAccountId,
+        });
         await new SimEcsTargetRun({
             scope: this.simAws.accountRegionScope(arn.accountId, arn.regionName),
         }).run({ cluster: arn.value, task: ecs.task, caller });

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-topic.js

@@ -1,6 +1,7 @@
 import { SimSnsServicePublishAuthorizer } from "../../sns/command/authorize/sim-sns-service-publish-authorizer.js";
 import { SimEventBridgeDeliveryNotPermitted, SimEventBridgeTargetNotFound, } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeDeliveryJson, simEventBridgeDeliverySource, simEventBridgeServicePrincipal, } from "./sim-event-bridge-delivery.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * A topic a simulated rule is sending an event to, in the Account and Region
  * the target ARN names.
@@ -26,7 +27,7 @@ export class SimEventBridgeDeliveryTopic {
             throw new SimEventBridgeTargetNotFound(`${targetArn.value} is not a simulated SNS topic.`);
         }
         const decision = new SimSnsServicePublishAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             topic,
             servicePrincipal: simEventBridgeServicePrincipal,

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
-import type { SimIam } from "../../iam/sim-iam.js";
-import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role.js";
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
+import type { SimServiceRoleSource } from "../../sts/service-role/sim-service-role-source.js";
 export type SimEventBridgeTargetRole = SimServiceRoleTarget;
 /**
  * Read the Account and name out of a target's role ARN.
@@ -14,5 +15,9 @@ export declare function eventBridgeTargetRole(roleArn: string): SimServiceRoleTa
  * policy, but there is no resource policy on a task definition for a rule to be
  * admitted by, so running a task is a call the rule makes as a role of the
  * account instead. Real EventBridge requires the role for that reason.
+ *
+ * The rule is the `aws:SourceArn` AWS documents for the trust policy condition
+ * it recommends against the confused deputy problem. It is the same rule ARN a
+ * queue or topic policy is conditioned on for the other target types.
  */
-export declare function assumeEventBridgeTargetRole(target: SimEventBridgeTargetRole, iam: SimIam): Promise<SimAwsCaller>;
+export declare function assumeEventBridgeTargetRole(target: SimEventBridgeTargetRole, scope: SimAwsAccountRegionContainer, source: SimServiceRoleSource): Promise<SimAwsCaller>;

package/dist/service/eventbridge/delivery/sim-event-bridge-target-role.js

@@ -1,4 +1,5 @@
-import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { assumeSimServiceRole, } from "../../sts/service-role/sim-service-role.js";
+import { simServiceRoleTarget, } from "../../sts/service-role/sim-service-role-target.js";
 import { SimEventBridgeDeliveryNotPermitted } from "../error/sim-event-bridge-delivery.error.js";
 import { simEventBridgeServicePrincipal } from "./sim-event-bridge-delivery.js";
 /**
@@ -29,13 +30,18 @@ const refusals = {
  * policy, but there is no resource policy on a task definition for a rule to be
  * admitted by, so running a task is a call the rule makes as a role of the
  * account instead. Real EventBridge requires the role for that reason.
+ *
+ * The rule is the `aws:SourceArn` AWS documents for the trust policy condition
+ * it recommends against the confused deputy problem. It is the same rule ARN a
+ * queue or topic policy is conditioned on for the other target types.
  */
-export async function assumeEventBridgeTargetRole(target, iam) {
+export async function assumeEventBridgeTargetRole(target, scope, source) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simEventBridgeServicePrincipal,
         sessionName,
-        iam,
+        scope,
+        source,
         refusals,
     });
 }

package/dist/service/eventbridge/sim-event-bridge.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimEventBusStore } from "./bus/sim-event-bus-store.js";
 import type * as simEventBridgeCommands from "./command/sim-event-bridge-command.types.js";
 import type { SimEventBridgeRequestOptions } from "./command/sim-event-bridge-request-options.js";

package/dist/service/eventbridge/sim-event-bridge.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimEventBus } from "./bus/sim-event-bus.js";
 import { SimEventBusStore } from "./bus/sim-event-bus-store.js";
 import { SimEventBridgeCommands } from "./command/sim-event-bridge-commands.js";
@@ -34,7 +34,8 @@ export class SimEventBridge extends SimEventBridgeInspection {
     });
     constructor(properties = {}) {
         super();
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.buses = new SimEventBusStore(SimEventBus.default({ accountRegionScope, createdAt: background.now() }));
         this.commands = new SimEventBridgeCommands({

package/dist/service/firehose/cfn/delivery-stream/sim-cfn-firehose-delivery-stream-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimFirehose } from "../../sim-firehose.js";
 import type { SimFirehoseDeliveryStream } from "../../stream/sim-firehose-delivery-stream.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnFirehoseDeliveryStreamCreatorProperties {
     readonly firehose: SimFirehose;
 }
@@ -27,6 +28,6 @@ export declare class SimCfnFirehoseDeliveryStreamCreator {
      * Create a delivery stream from an AWS::KinesisFirehose::DeliveryStream
      * Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimFirehoseDeliveryStream>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimFirehoseDeliveryStream>;
 }
 export {};

package/dist/service/firehose/cfn/delivery-stream/sim-cfn-firehose-delivery-stream-creator.js

@@ -26,14 +26,14 @@ export class SimCfnFirehoseDeliveryStreamCreator {
      * Create a delivery stream from an AWS::KinesisFirehose::DeliveryStream
      * Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         return await simCfnFirehoseResourceCreation(firehoseDeliveryStreamResourceType, resource.logicalId, async () => {
             const streamProperties = new SimCfnFirehoseDeliveryStreamProperties({
                 resource,
                 properties,
             });
             const input = streamProperties.createInput();
-            await this.firehose.createDeliveryStream({ input });
+            await this.firehose.createDeliveryStream({ input }, options);
             const deliveryStream = this.firehose.findDeliveryStream(streamProperties.name());
             assertDefined(deliveryStream, `sim Firehose delivery stream ${streamProperties.name()} after ` +
                 `CloudFormation creation`);

package/dist/service/firehose/cfn/sim-cfn-firehose-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimFirehose } from "../sim-firehose.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnFirehoseResourceDeleterProperties {
     readonly firehose: SimFirehose;
 }
@@ -13,6 +14,6 @@ export declare class SimCfnFirehoseResourceDeleter {
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/firehose/cfn/sim-cfn-firehose-resource-deleter.js

@@ -12,14 +12,12 @@ export class SimCfnFirehoseResourceDeleter {
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== firehoseDeliveryStreamResourceTypeName) {
             throw new Error(`Unsupported sim Firehose CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const deliveryStream = resource.simResource;
         assertDefined(deliveryStream, `sim Firehose delivery stream for CloudFormation Resource ${resource.logicalId}`);
-        await this.firehose.deleteDeliveryStream({
-            input: { DeliveryStreamName: deliveryStream.name },
-        });
+        await this.firehose.deleteDeliveryStream({ input: { DeliveryStreamName: deliveryStream.name } }, options);
     }
 }

package/dist/service/firehose/cfn/sim-firehose-cfn-resource-factory.d.ts

@@ -23,6 +23,6 @@ export declare class SimFirehoseCfnResourceFactory implements SimCfnServiceResou
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/firehose/cfn/sim-firehose-cfn-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnFirehoseDeliveryStreamCreator } from "./delivery-stream/sim-cfn-firehose-delivery-stream-creator.js";
 import { SimCfnFirehoseResourceDeleter } from "./sim-cfn-firehose-resource-deleter.js";
 import { firehoseDeliveryStreamResourceTypeName } from "./sim-cfn-firehose-resource-types.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Firehose resources.
  */
@@ -25,13 +26,13 @@ export class SimFirehoseCfnResourceFactory {
         if (resourceTypeName !== firehoseDeliveryStreamResourceTypeName) {
             throw new Error(`Unsupported sim Firehose CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.deliveryStreamCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.deliveryStreamCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Firehose resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/firehose/sim-firehose.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simFirehoseCommands from "./command/sim-firehose-command.types.js";
 import type { SimFirehoseRequestOptions } from "./command/sim-firehose-request-options.js";
 import { SimFirehoseCfnResourceFactory } from "./cfn/sim-firehose-cfn-resource-factory.js";

package/dist/service/firehose/sim-firehose.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimFirehoseCommands } from "./command/sim-firehose-commands.js";
 import { SimFirehoseCfnResourceFactory } from "./cfn/sim-firehose-cfn-resource-factory.js";
 import { SimFirehoseFailures } from "./failure/sim-firehose-failures.js";
@@ -40,7 +40,8 @@ export class SimFirehose {
         firehose: this,
     });
     constructor(properties) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), kinesis = new SimFirehoseNoRecordSource(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), kinesis = new SimFirehoseNoRecordSource(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimFirehoseCommands({
             deliveryStreams: this.deliveryStreams,

package/dist/service/glue/sim-glue.d.ts

@@ -2,7 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simGlueCommands from "./command/database/database.command.js";
 import type * as simGlueTableCommands from "./command/table/table.command.js";
 import type * as simGluePartitionCommands from "./command/partition/partition.command.js";

package/dist/service/glue/sim-glue.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimGlueAuthorizer } from "./command/authorize/sim-glue-authorizer.js";
 import { SimGlueDatabaseCommands } from "./command/database/sim-glue-database-commands.js";
 import { SimGlueTableCommands } from "./command/table/sim-glue-table-commands.js";
@@ -36,7 +36,8 @@ export class SimGlue {
     #sdkRouter = new SimGlueSdkCommandRouter(this);
     #cfnFactory;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const authorizer = new SimGlueAuthorizer({ iam, accountRegionScope });
         this.#databases = new SimGlueDatabaseStore({ accountRegionScope });
         this.#tables = new SimGlueTableStore({ accountRegionScope });

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,4 +1,5 @@
 import type { SimArn } from "../../../aws/arn.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
@@ -21,6 +22,17 @@ export interface SimIamResourcePolicyInput {
 export interface SimIamAuthorizationInput {
     readonly action: string;
     readonly resource: string;
+    /**
+     * The Region the request was made in, which sim IAM derives
+     * `aws:RequestedRegion` from.
+     *
+     * A simulated service supplies its own Region. A request reaching one
+     * through its command handlers therefore carries it, with the caller saying
+     * nothing. IAM itself belongs to an Account and has no Region to fall back
+     * on. A request arriving without one leaves the key out of the condition
+     * context, and a statement conditioned on it matches nothing.
+     */
+    readonly region?: AwsRegionName | undefined;
     /**
      * Condition values known by the service handling the simulated request, such
      * as S3 object tags. Sim IAM automatically supplies global condition values
@@ -119,6 +131,7 @@ export declare class SimIamAuthZContextBuilder {
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
     private readonly allowRequirement;
+    private readonly derivedConditions;
     private readonly scpSourceBuilder;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
@@ -139,23 +152,14 @@ export declare class SimIamAuthZContextBuilder {
      */
     private ownIdentityPolicySources;
     /**
-     * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller.
+     * Combine service-provided condition values with the global values IAM
+     * derives itself.
      *
      * A service supplies values it knows from the request, and values it can
      * only work out once the caller is resolved. IAM's own values are applied
      * last, so nothing a service supplies can overwrite them.
      */
     private conditionContext;
-    /**
-     * The condition values IAM derives from the caller itself.
-     *
-     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
-     * temporary Role credentials this is the underlying Role ARN, rather than
-     * the STS assumed-role session ARN retained as the effective caller for
-     * diagnostics.
-     */
-    private callerDerivedConditions;
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -4,6 +4,7 @@ import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 import { SimIamAuthZScpSourceBuilder } from "./sim-iam-auth-z-scp-source-builder.js";
+import { SimIamDerivedConditions } from "./sim-iam-derived-conditions.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -39,6 +40,7 @@ export class SimIamAuthZContextBuilder {
     identityPolicyCoordinator;
     callerAccountResolver;
     allowRequirement = new SimIamAuthZAllowRequirement();
+    derivedConditions = new SimIamDerivedConditions();
     scpSourceBuilder;
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
@@ -97,8 +99,8 @@ export class SimIamAuthZContextBuilder {
         ];
     }
     /**
-     * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller.
+     * Combine service-provided condition values with the global values IAM
+     * derives itself.
      *
      * A service supplies values it knows from the request, and values it can
      * only work out once the caller is resolved. IAM's own values are applied
@@ -108,24 +110,9 @@ export class SimIamAuthZContextBuilder {
         return {
             ...input.conditionContext,
             ...input.callerConditions?.conditionValuesFor(caller),
-            ...this.callerDerivedConditions(caller),
+            ...this.derivedConditions.of({ caller, region: input.region }),
         };
     }
-    /**
-     * The condition values IAM derives from the caller itself.
-     *
-     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
-     * temporary Role credentials this is the underlying Role ARN, rather than
-     * the STS assumed-role session ARN retained as the effective caller for
-     * diagnostics.
-     */
-    callerDerivedConditions(caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return {};
-        }
-        return { "aws:PrincipalArn": principalArn };
-    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-derived-conditions.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+import type { SimIamConditionValue } from "../../policy/sim-iam-policy.js";
+/**
+ * What a request has to say about itself for IAM to derive its global
+ * condition values.
+ */
+export interface SimIamDerivedConditionRequest {
+    readonly caller: SimAwsResolvedCaller;
+    readonly region?: AwsRegionName | undefined;
+}
+/**
+ * The global condition values IAM works out for itself.
+ *
+ * These are the keys a policy can be written against without the service
+ * handling the request supplying anything. They are applied over the values a
+ * service does supply. A service cannot overwrite one of them.
+ *
+ * A key the request leaves unsaid is left out. The condition matcher counts a
+ * missing key as no match, and a statement conditioned on one then matches
+ * nothing.
+ */
+export declare class SimIamDerivedConditions {
+    /**
+     * Derive what IAM knows about this request.
+     */
+    of(request: SimIamDerivedConditionRequest): Readonly<Record<string, SimIamConditionValue>>;
+    /**
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply. For
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    private principalArn;
+    /**
+     * AWS:RequestedRegion is the Region the request was made in, which on real
+     * AWS is the Region of the endpoint it was sent to. Here it is the Region of
+     * the simulated service handling the request. A service in one Region's
+     * scope answers only requests made to that Region.
+     */
+    private region;
+}