@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -4,6 +4,7 @@ import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 import { SimIamAuthZScpSourceBuilder } from "./sim-iam-auth-z-scp-source-builder.js";
+import { SimIamDerivedConditions } from "./sim-iam-derived-conditions.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -39,6 +40,7 @@ export class SimIamAuthZContextBuilder {
     identityPolicyCoordinator;
     callerAccountResolver;
     allowRequirement = new SimIamAuthZAllowRequirement();
+    derivedConditions = new SimIamDerivedConditions();
     scpSourceBuilder;
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
@@ -97,8 +99,8 @@ export class SimIamAuthZContextBuilder {
         ];
     }
     /**
-     * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller.
+     * Combine service-provided condition values with the global values IAM
+     * derives itself.
      *
      * A service supplies values it knows from the request, and values it can
      * only work out once the caller is resolved. IAM's own values are applied
@@ -108,24 +110,9 @@ export class SimIamAuthZContextBuilder {
         return {
             ...input.conditionContext,
             ...input.callerConditions?.conditionValuesFor(caller),
-            ...this.callerDerivedConditions(caller),
+            ...this.derivedConditions.of({ caller, region: input.region }),
         };
     }
-    /**
-     * The condition values IAM derives from the caller itself.
-     *
-     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
-     * temporary Role credentials this is the underlying Role ARN, rather than
-     * the STS assumed-role session ARN retained as the effective caller for
-     * diagnostics.
-     */
-    callerDerivedConditions(caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return {};
-        }
-        return { "aws:PrincipalArn": principalArn };
-    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-derived-conditions.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+import type { SimIamConditionValue } from "../../policy/sim-iam-policy.js";
+/**
+ * What a request has to say about itself for IAM to derive its global
+ * condition values.
+ */
+export interface SimIamDerivedConditionRequest {
+    readonly caller: SimAwsResolvedCaller;
+    readonly region?: AwsRegionName | undefined;
+}
+/**
+ * The global condition values IAM works out for itself.
+ *
+ * These are the keys a policy can be written against without the service
+ * handling the request supplying anything. They are applied over the values a
+ * service does supply. A service cannot overwrite one of them.
+ *
+ * A key the request leaves unsaid is left out. The condition matcher counts a
+ * missing key as no match, and a statement conditioned on one then matches
+ * nothing.
+ */
+export declare class SimIamDerivedConditions {
+    /**
+     * Derive what IAM knows about this request.
+     */
+    of(request: SimIamDerivedConditionRequest): Readonly<Record<string, SimIamConditionValue>>;
+    /**
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply. For
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    private principalArn;
+    /**
+     * AWS:RequestedRegion is the Region the request was made in, which on real
+     * AWS is the Region of the endpoint it was sent to. Here it is the Region of
+     * the simulated service handling the request. A service in one Region's
+     * scope answers only requests made to that Region.
+     */
+    private region;
+}

package/dist/service/iam/authorize/context/sim-iam-derived-conditions.js

@@ -0,0 +1,44 @@
+/**
+ * The global condition values IAM works out for itself.
+ *
+ * These are the keys a policy can be written against without the service
+ * handling the request supplying anything. They are applied over the values a
+ * service does supply. A service cannot overwrite one of them.
+ *
+ * A key the request leaves unsaid is left out. The condition matcher counts a
+ * missing key as no match, and a statement conditioned on one then matches
+ * nothing.
+ */
+export class SimIamDerivedConditions {
+    /**
+     * Derive what IAM knows about this request.
+     */
+    of(request) {
+        return { ...this.principalArn(request.caller), ...this.region(request) };
+    }
+    /**
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply. For
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    principalArn(caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return {};
+        }
+        return { "aws:PrincipalArn": principalArn };
+    }
+    /**
+     * AWS:RequestedRegion is the Region the request was made in, which on real
+     * AWS is the Region of the endpoint it was sent to. Here it is the Region of
+     * the simulated service handling the request. A service in one Region's
+     * scope answers only requests made to that Region.
+     */
+    region(request) {
+        if (request.region === undefined) {
+            return {};
+        }
+        return { "aws:RequestedRegion": request.region };
+    }
+}

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.js

@@ -1,4 +1,4 @@
-import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { simIamArnComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `ArnEquals` condition operator.
@@ -11,6 +11,6 @@ import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar
  */
 export class SimIamArnEquals extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamArnMatch(expected, actual);
+        return simIamArnComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.js

@@ -1,4 +1,4 @@
-import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { simIamArnComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `ArnLike` condition operator.
@@ -10,6 +10,6 @@ import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar
  */
 export class SimIamArnLike extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamArnMatch(expected, actual);
+        return simIamArnComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * A `ForAllValues` negated IAM string operator, such as
+ * `ForAllValues:StringNotEquals`.
+ *
+ * Every request value has to differ from every policy value. A request
+ * supplying no values leaves nothing to contradict that, so an empty set
+ * matches, as an absent key does.
+ */
+export declare class SimIamNegatedForAllValuesStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = true;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether every request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.js

@@ -0,0 +1,27 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * A `ForAllValues` negated IAM string operator, such as
+ * `ForAllValues:StringNotEquals`.
+ *
+ * Every request value has to differ from every policy value. A request
+ * supplying no values leaves nothing to contradict that, so an empty set
+ * matches, as an absent key does.
+ */
+export class SimIamNegatedForAllValuesStringOperator {
+    comparison;
+    matchesAbsentKey = true;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether every request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        const actualValues = simIamStringValues(actual);
+        const expectedValues = simIamStringValues(expected);
+        if (actualValues === undefined || expectedValues === undefined) {
+            return false;
+        }
+        return actualValues.every((actualValue) => expectedValues.every((expectedValue) => !this.comparison(actualValue, expectedValue)));
+    }
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * A `ForAnyValue` negated IAM string operator, such as
+ * `ForAnyValue:StringNotEquals`.
+ *
+ * One request value differing from every policy value is enough. A request
+ * supplying no such value satisfies nothing, which covers both an empty value
+ * set and a key the request omits. The `ForAnyValue` qualifier settles the
+ * absent key here, ahead of the rule that a negated operator matches one.
+ */
+export declare class SimIamNegatedForAnyValueStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = false;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether any request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.js

@@ -0,0 +1,28 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * A `ForAnyValue` negated IAM string operator, such as
+ * `ForAnyValue:StringNotEquals`.
+ *
+ * One request value differing from every policy value is enough. A request
+ * supplying no such value satisfies nothing, which covers both an empty value
+ * set and a key the request omits. The `ForAnyValue` qualifier settles the
+ * absent key here, ahead of the rule that a negated operator matches one.
+ */
+export class SimIamNegatedForAnyValueStringOperator {
+    comparison;
+    matchesAbsentKey = false;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether any request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        const actualValues = simIamStringValues(actual);
+        const expectedValues = simIamStringValues(expected);
+        if (actualValues === undefined || expectedValues === undefined) {
+            return false;
+        }
+        return actualValues.some((actualValue) => expectedValues.every((expectedValue) => !this.comparison(actualValue, expectedValue)));
+    }
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-operator-factories.d.ts

@@ -0,0 +1,5 @@
+import type { SimIamConditionOperatorFactory } from "../sim-iam-condition-operator.js";
+/**
+ * Every negated condition operator sim IAM evaluates, keyed by its keyword.
+ */
+export declare const simIamNegatedOperatorFactories: ReadonlyMap<string, SimIamConditionOperatorFactory>;

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-operator-factories.js

@@ -0,0 +1,36 @@
+import { simIamArnComparison, simIamStringEqualsComparison, simIamStringLikeComparison, } from "../sim-iam-string-comparison.js";
+import { SimIamNegatedForAllValuesStringOperator } from "./sim-iam-negated-for-all-values-string-operator.js";
+import { SimIamNegatedForAnyValueStringOperator } from "./sim-iam-negated-for-any-value-string-operator.js";
+import { SimIamNegatedScalarStringOperator } from "./sim-iam-negated-scalar-string-operator.js";
+/**
+ * The comparison behind each negated operator keyword.
+ */
+const negatedComparisons = new Map([
+    ["ArnNotEquals", simIamArnComparison],
+    ["ArnNotLike", simIamArnComparison],
+    ["StringNotEquals", simIamStringEqualsComparison],
+    ["StringNotLike", simIamStringLikeComparison],
+]);
+/**
+ * Build the unqualified and set forms of one negated keyword.
+ */
+function keywordForms(keyword, comparison) {
+    return [
+        [
+            keyword,
+            () => new SimIamNegatedScalarStringOperator(comparison),
+        ],
+        [
+            `ForAnyValue:${keyword}`,
+            () => new SimIamNegatedForAnyValueStringOperator(comparison),
+        ],
+        [
+            `ForAllValues:${keyword}`,
+            () => new SimIamNegatedForAllValuesStringOperator(comparison),
+        ],
+    ];
+}
+/**
+ * Every negated condition operator sim IAM evaluates, keyed by its keyword.
+ */
+export const simIamNegatedOperatorFactories = new Map([...negatedComparisons].flatMap(([keyword, comparison]) => keywordForms(keyword, comparison)));

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * An unqualified negated IAM string operator, such as `StringNotEquals`.
+ *
+ * The request value must be scalar, as it must for the positive operators.
+ * Several policy values are an AND rather than an OR: the request value has to
+ * differ from every one of them, so a carve-out naming three roles exempts all
+ * three.
+ */
+export declare class SimIamNegatedScalarStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = true;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether a request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.js

@@ -0,0 +1,29 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * An unqualified negated IAM string operator, such as `StringNotEquals`.
+ *
+ * The request value must be scalar, as it must for the positive operators.
+ * Several policy values are an AND rather than an OR: the request value has to
+ * differ from every one of them, so a carve-out naming three roles exempts all
+ * three.
+ */
+export class SimIamNegatedScalarStringOperator {
+    comparison;
+    matchesAbsentKey = true;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether a request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        if (typeof actual !== "string") {
+            return false;
+        }
+        const expectedValues = simIamStringValues(expected);
+        if (expectedValues === undefined) {
+            return false;
+        }
+        return expectedValues.every((expectedValue) => !this.comparison(actual, expectedValue));
+    }
+}

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.d.ts

@@ -15,6 +15,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export declare class SimIamNumericLessThanEquals implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.js

@@ -13,6 +13,7 @@
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export class SimIamNumericLessThanEquals {
+    matchesAbsentKey = false;
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/sim-iam-condition-match.d.ts

@@ -0,0 +1,26 @@
+/**
+ * What reading one statement's condition block told the simulator.
+ *
+ * A condition block either matched the request or it did not, and separately
+ * from that it may have held an operator sim IAM has no implementation for.
+ * The two facts travel together because a statement carrying an unread
+ * operator does not match, and a caller that only reads `matched` cannot tell
+ * that apart from a condition the simulator read and rejected.
+ */
+export interface SimIamConditionMatch {
+    /**
+     * Whether the whole condition block matched the request.
+     *
+     * An operator the simulator cannot evaluate fails closed. A block holding
+     * one never matches.
+     */
+    readonly matched: boolean;
+    /**
+     * The operator keywords sim IAM has no implementation for.
+     *
+     * These are reported only where every other operator in the block matched.
+     * A block ruled out by an operator the simulator did read needs nothing
+     * said about it: the statement would not have matched either way.
+     */
+    readonly unsupportedOperators: readonly string[];
+}

package/dist/service/iam/authorize/match/condition/sim-iam-condition-match.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -1,3 +1,4 @@
+import { simIamNegatedOperatorFactories } from "./negated/sim-iam-negated-operator-factories.js";
 import { SimIamForAllValuesStringEquals } from "./string/all-values/sim-iam-for-all-values-string-equals.js";
 import { SimIamForAllValuesStringLike } from "./string/all-values/sim-iam-for-all-values-string-like.js";
 import { SimIamForAnyValueStringEquals } from "./string/any-value/sim-iam-for-any-value-string-equals.js";
@@ -32,6 +33,7 @@ const operatorFactories = new Map([
         "ForAllValues:StringLike",
         () => new SimIamForAllValuesStringLike(),
     ],
+    ...simIamNegatedOperatorFactories,
 ]);
 /**
  * Parses IAM condition operator keywords into their behavior objects.

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator.d.ts

@@ -7,8 +7,23 @@ import type { SimIamConditionValue } from "../../../policy/sim-iam-policy.js";
  * matcher.
  */
 export interface SimIamConditionOperator {
+    /**
+     * Whether the operator matches a request carrying no value for the key.
+     *
+     * An unqualified positive operator has nothing to compare and matches
+     * nothing, while its negated form matches. With no value in the request
+     * there is none for the policy value to equal.
+     *
+     * A `ForAnyValue` operator answers false whatever it wraps, because no
+     * request value is there to satisfy it. AWS documents both rules.
+     */
+    readonly matchesAbsentKey: boolean;
     /**
      * Determine whether an actual request value satisfies the expected policy value.
      */
     matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
 }
+/**
+ * Builds a fresh condition operator for one keyword.
+ */
+export type SimIamConditionOperatorFactory = () => SimIamConditionOperator;

package/dist/service/iam/authorize/match/condition/sim-iam-policy-condition-matcher.d.ts

@@ -1,4 +1,5 @@
 import type { SimIamConditionValue, SimIamPolicyDocumentCondition } from "../../../policy/sim-iam-policy.js";
+import type { SimIamConditionMatch } from "./sim-iam-condition-match.js";
 import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-parser.js";
 /**
  * Matches IAM policy conditions against request condition-context values.
@@ -7,19 +8,26 @@ import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-pars
  * key lookup. Individual condition operators encapsulate value validation,
  * comparison, and set semantics.
  *
- * Unsupported operators and missing context keys fail closed by making the
- * condition non-matching.
+ * An unsupported operator fails closed by making the condition non-matching,
+ * and is named in the result so the decision can report the statement as one
+ * it never read. A context key the request carries no value for is left to the
+ * operator, which answers for itself whether an absent key matches it.
  */
 export declare class SimIamPolicyConditionMatcher {
     private readonly operatorParser;
+    private static readonly noCondition;
     private readonly conditionContext;
     constructor(conditionContext: Readonly<Record<string, SimIamConditionValue>>, operatorParser?: SimIamConditionOperatorParser);
     /**
      * Match every operator and every key in a condition block.
      *
      * Separate operators and separate keys use logical AND semantics.
+     *
+     * Every operator in the block is read. Stopping at the first that fails
+     * would leave the operators the simulator could not evaluate depending on
+     * the order the policy happens to list them in.
      */
-    matches(condition: SimIamPolicyDocumentCondition | undefined): boolean;
+    matches(condition: SimIamPolicyDocumentCondition | undefined): SimIamConditionMatch;
     private operatorMatches;
     private entryMatches;
     private normalizeContextKey;

package/dist/service/iam/authorize/match/condition/sim-iam-policy-condition-matcher.js

@@ -6,11 +6,17 @@ import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-pars
  * key lookup. Individual condition operators encapsulate value validation,
  * comparison, and set semantics.
  *
- * Unsupported operators and missing context keys fail closed by making the
- * condition non-matching.
+ * An unsupported operator fails closed by making the condition non-matching,
+ * and is named in the result so the decision can report the statement as one
+ * it never read. A context key the request carries no value for is left to the
+ * operator, which answers for itself whether an absent key matches it.
  */
 export class SimIamPolicyConditionMatcher {
     operatorParser;
+    static noCondition = {
+        matched: true,
+        unsupportedOperators: [],
+    };
     conditionContext;
     constructor(conditionContext, operatorParser = new SimIamConditionOperatorParser()) {
         this.operatorParser = operatorParser;
@@ -23,25 +29,37 @@ export class SimIamPolicyConditionMatcher {
      * Match every operator and every key in a condition block.
      *
      * Separate operators and separate keys use logical AND semantics.
+     *
+     * Every operator in the block is read. Stopping at the first that fails
+     * would leave the operators the simulator could not evaluate depending on
+     * the order the policy happens to list them in.
      */
     matches(condition) {
         if (condition === undefined) {
-            return true;
+            return SimIamPolicyConditionMatcher.noCondition;
         }
-        return Object.entries(condition).every(([keyword, keyValues]) => this.operatorMatches(keyword, keyValues));
-    }
-    operatorMatches(keyword, keyValues) {
-        const operator = this.operatorParser.parse(keyword);
-        /* v8 ignore if -- defensive */
-        if (operator === undefined) {
-            return false;
+        const unsupportedOperators = [];
+        let matched = true;
+        for (const [keyword, keyValues] of Object.entries(condition)) {
+            const operator = this.operatorParser.parse(keyword);
+            if (operator === undefined) {
+                unsupportedOperators.push(keyword);
+                continue;
+            }
+            matched = this.operatorMatches(operator, keyValues) && matched;
         }
+        return {
+            matched: matched && unsupportedOperators.length === 0,
+            unsupportedOperators: matched ? unsupportedOperators : [],
+        };
+    }
+    operatorMatches(operator, keyValues) {
         return Object.entries(keyValues).every(([key, expected]) => this.entryMatches(operator, key, expected));
     }
     entryMatches(operator, key, expected) {
         const actual = this.conditionContext.get(this.normalizeContextKey(key));
         if (actual === undefined) {
-            return false;
+            return operator.matchesAbsentKey;
         }
         return operator.matches(actual, expected);
     }

package/dist/service/iam/authorize/match/condition/sim-iam-string-comparison.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Compares one request value with one policy value.
+ *
+ * Condition operators differ in how they quantify over the values on each
+ * side, and in whether they negate the result. The comparison of a single
+ * pair is the part they share, so `StringNotLike` is the same comparison as
+ * `StringLike` with the answer turned around.
+ */
+export type SimIamStringComparison = (actual: string, expected: string) => boolean;
+/**
+ * The comparison `StringEquals` and `StringNotEquals` are built from.
+ */
+export declare const simIamStringEqualsComparison: SimIamStringComparison;
+/**
+ * The comparison `StringLike` and `StringNotLike` are built from.
+ */
+export declare const simIamStringLikeComparison: SimIamStringComparison;
+/**
+ * The comparison the four ARN operators are built from.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically, so one
+ * comparison serves both of them and both of their negated forms.
+ */
+export declare const simIamArnComparison: SimIamStringComparison;

package/dist/service/iam/authorize/match/condition/sim-iam-string-comparison.js

@@ -0,0 +1,17 @@
+import { simIamArnMatch } from "../../sim-iam-arn-match.js";
+import { simIamWildcardMatch } from "../../sim-iam-wildcard.js";
+/**
+ * The comparison `StringEquals` and `StringNotEquals` are built from.
+ */
+export const simIamStringEqualsComparison = (actual, expected) => actual === expected;
+/**
+ * The comparison `StringLike` and `StringNotLike` are built from.
+ */
+export const simIamStringLikeComparison = (actual, expected) => simIamWildcardMatch(expected, actual, { caseSensitive: true });
+/**
+ * The comparison the four ARN operators are built from.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically, so one
+ * comparison serves both of them and both of their negated forms.
+ */
+export const simIamArnComparison = (actual, expected) => simIamArnMatch(expected, actual);

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.d.ts

@@ -4,6 +4,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * Base for `ForAllValues` IAM string operators.
  */
 export declare abstract class SimIamForAllValuesStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.js

@@ -3,6 +3,7 @@ import { simIamStringValues } from "../sim-iam-string-values.js";
  * Base for `ForAllValues` IAM string operators.
  */
 export class SimIamForAllValuesStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAllValuesStringConditionOperator } from "./sim-iam-for-all-values-string-condition-operator.js";
 /**
  * IAM `ForAllValues:StringEquals` condition operator.
  */
 export class SimIamForAllValuesStringEquals extends SimIamForAllValuesStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAllValuesStringConditionOperator } from "./sim-iam-for-all-values-string-condition-operator.js";
 /**
  * IAM `ForAllValues:StringLike` condition operator.
  */
 export class SimIamForAllValuesStringLike extends SimIamForAllValuesStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }