@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.d.ts

@@ -4,6 +4,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * Base for `ForAnyValue` IAM string operators.
  */
 export declare abstract class SimIamForAnyValueStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.js

@@ -3,6 +3,7 @@ import { simIamStringValues } from "../sim-iam-string-values.js";
  * Base for `ForAnyValue` IAM string operators.
  */
 export class SimIamForAnyValueStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAnyValueStringConditionOperator } from "./sim-iam-for-any-value-string-condition-operator.js";
 /**
  * IAM `ForAnyValue:StringEquals` condition operator.
  */
 export class SimIamForAnyValueStringEquals extends SimIamForAnyValueStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAnyValueStringConditionOperator } from "./sim-iam-for-any-value-string-condition-operator.js";
 /**
  * IAM `ForAnyValue:StringLike` condition operator.
  */
 export class SimIamForAnyValueStringLike extends SimIamForAnyValueStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/equals/sim-iam-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `StringEquals` condition operator.
  */
 export class SimIamStringEquals extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/like/sim-iam-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `StringLike` condition operator.
  */
 export class SimIamStringLike extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.d.ts

@@ -7,6 +7,7 @@ import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
  * scalar or an array, with multiple policy values using OR semantics.
  */
 export declare abstract class SimIamScalarStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.js

@@ -6,6 +6,7 @@ import { simIamStringValues } from "./sim-iam-string-values.js";
  * scalar or an array, with multiple policy values using OR semantics.
  */
 export class SimIamScalarStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -1,6 +1,7 @@
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
-import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamUnevaluatedStatements } from "../unevaluated/sim-iam-unevaluated-statements.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -18,12 +19,23 @@ import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
  * - Action and NotAction;
  * - Resource and NotResource;
  * - supported IAM string conditions.
+ *
+ * One matcher reads every policy of one request, and it is also where the
+ * statements the simulator could not evaluate are collected. A statement is
+ * recorded only once everything else about it has matched. Each entry is a
+ * statement that would have applied to this request had its condition been
+ * readable.
  */
 export declare class SimIamPolicyStatementMatcher {
     private readonly context;
     private readonly conditionMatcher;
     private readonly principalMatcher;
+    private readonly unevaluated;
     constructor(context: SimIamAuthZContext);
+    /**
+     * The statements read so far that the simulator could not evaluate.
+     */
+    get unevaluatedStatements(): SimIamUnevaluatedStatements;
     /**
      * Check whether a parsed statement applies to the current request.
      *
@@ -32,6 +44,11 @@ export declare class SimIamPolicyStatementMatcher {
      * statement.
      */
     matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
+    /**
+     * Check the statement's condition block, recording it as unevaluated where
+     * an operator stopped the simulator reading it.
+     */
+    private conditionMatches;
     /**
      * Check Action or NotAction against the requested IAM action.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -1,6 +1,8 @@
 import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
 import { SimIamPolicyConditionMatcher } from "./condition/sim-iam-policy-condition-matcher.js";
 import { SimIamPolicyPrincipalMatcher } from "./sim-iam-policy-principal-matcher.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamUnevaluatedStatements } from "../unevaluated/sim-iam-unevaluated-statements.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -18,16 +20,29 @@ import { SimIamPolicyPrincipalMatcher } from "./sim-iam-policy-principal-matcher
  * - Action and NotAction;
  * - Resource and NotResource;
  * - supported IAM string conditions.
+ *
+ * One matcher reads every policy of one request, and it is also where the
+ * statements the simulator could not evaluate are collected. A statement is
+ * recorded only once everything else about it has matched. Each entry is a
+ * statement that would have applied to this request had its condition been
+ * readable.
  */
 export class SimIamPolicyStatementMatcher {
     context;
     conditionMatcher;
     principalMatcher;
+    unevaluated = new SimIamUnevaluatedStatements();
     constructor(context) {
         this.context = context;
         this.conditionMatcher = new SimIamPolicyConditionMatcher(context.conditionContext);
         this.principalMatcher = new SimIamPolicyPrincipalMatcher(context);
     }
+    /**
+     * The statements read so far that the simulator could not evaluate.
+     */
+    get unevaluatedStatements() {
+        return this.unevaluated;
+    }
     /**
      * Check whether a parsed statement applies to the current request.
      *
@@ -37,10 +52,23 @@ export class SimIamPolicyStatementMatcher {
      */
     matches(policy, statement) {
         const principal = this.principalMatcher.matches(policy, statement);
-        return principal.when(principal.matched &&
-            this.actionMatches(statement) &&
-            this.resourceMatches(policy, statement) &&
-            this.conditionMatcher.matches(statement.condition));
+        if (!principal.matched ||
+            !this.actionMatches(statement) ||
+            !this.resourceMatches(policy, statement)) {
+            return SimIamPrincipalMatch.none();
+        }
+        return principal.when(this.conditionMatches(policy, statement));
+    }
+    /**
+     * Check the statement's condition block, recording it as unevaluated where
+     * an operator stopped the simulator reading it.
+     */
+    conditionMatches(policy, statement) {
+        const condition = this.conditionMatcher.matches(statement.condition);
+        for (const operator of condition.unsupportedOperators) {
+            this.unevaluated.record(policy, statement.source, `unsupported condition operator ${operator}`);
+        }
+        return condition.matched;
     }
     /**
      * Check Action or NotAction against the requested IAM action.

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -4,6 +4,7 @@ import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-par
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
 import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+import type { SimIamUnevaluatedStatement } from "./unevaluated/sim-iam-unevaluated-statement.type.js";
 export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
@@ -33,6 +34,7 @@ export declare class SimIamPolicyDecision {
     private readonly request;
     private readonly policies;
     private readonly scpGate;
+    private readonly statementMatcher;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -97,6 +99,16 @@ export declare class SimIamPolicyDecision {
      * from each side.
      */
     get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The statements the simulator could not evaluate, and why.
+     *
+     * Sim IAM fails closed on a condition operator it has no implementation
+     * for, and a statement holding one matches nothing. A Deny that would have
+     * stopped the request in a real account leaves an ordinary Allow here. A
+     * decision reached over policies the simulator read in full reports
+     * nothing.
+     */
+    get unevaluatedStatements(): readonly SimIamUnevaluatedStatement[];
     /**
      * Matching Allow statements from identity-based policies.
      */

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -32,9 +32,11 @@ export class SimIamPolicyDecision {
     request;
     policies;
     scpGate;
+    statementMatcher;
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
         const statementMatcher = new SimIamPolicyStatementMatcher(request);
         this.request = request;
+        this.statementMatcher = statementMatcher;
         this.policies = new SimIamPolicyEvaluation({
             policies: [...request.identityPolicies, ...request.resourcePolicies],
             policyDocumentParser,
@@ -142,6 +144,18 @@ export class SimIamPolicyDecision {
     get allowStatements() {
         return this.policies.allowStatements.all;
     }
+    /**
+     * The statements the simulator could not evaluate, and why.
+     *
+     * Sim IAM fails closed on a condition operator it has no implementation
+     * for, and a statement holding one matches nothing. A Deny that would have
+     * stopped the request in a real account leaves an ordinary Allow here. A
+     * decision reached over policies the simulator read in full reports
+     * nothing.
+     */
+    get unevaluatedStatements() {
+        return this.statementMatcher.unevaluatedStatements.all;
+    }
     /**
      * Matching Allow statements from identity-based policies.
      */

package/dist/service/iam/authorize/sim-iam-region-auth-z.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import { type SimIamInterServiceAuthZ } from "./sim-iam-inter-service-auth-z.js";
+/**
+ * The Region a global service's requests are made in.
+ *
+ * IAM, CloudFront and Route53 each have one endpoint between all Regions, and
+ * that endpoint is in us-east-1. A request to one is made in us-east-1
+ * wherever the caller is. A service control policy confining an Account to a
+ * list of Regions therefore has to leave the global services' actions out of
+ * the condition, or it loses access to all of them.
+ */
+export declare const simIamGlobalServiceRegion: AwsRegionName;
+/**
+ * The IAM one simulated service authorizes against, bound to its Region.
+ *
+ * A service is built for one Account and Region, and this is where it tells
+ * IAM which. A service built without IAM (a service constructed on its own,
+ * outside a simulation) gets the permissive fallback it has always had, bound
+ * to the same Region.
+ */
+export declare function simIamInRegion(iam: SimIamInterServiceAuthZ | undefined, regionName: AwsRegionName): SimIamInterServiceAuthZ;
+/**
+ * The IAM deciding the requests made to one Account and Region scope.
+ *
+ * A service reaching into another scope authorizes there. Both the IAM and
+ * the Region come from the scope being reached into, wherever the request
+ * came from. This is what a scheduled invocation, an event delivery and an
+ * HTTP request served on a function's behalf all decide against.
+ */
+export declare function simScopeIamAuthZ(scope: SimAwsAccountRegionContainer): SimIamInterServiceAuthZ;

package/dist/service/iam/authorize/sim-iam-region-auth-z.js

@@ -0,0 +1,65 @@
+import { SimIamAllowAllAuth, } from "./sim-iam-inter-service-auth-z.js";
+/**
+ * The Region a global service's requests are made in.
+ *
+ * IAM, CloudFront and Route53 each have one endpoint between all Regions, and
+ * that endpoint is in us-east-1. A request to one is made in us-east-1
+ * wherever the caller is. A service control policy confining an Account to a
+ * list of Regions therefore has to leave the global services' actions out of
+ * the condition, or it loses access to all of them.
+ */
+export const simIamGlobalServiceRegion = "us-east-1";
+/**
+ * IAM authorization for the requests one Region's services make.
+ *
+ * IAM belongs to an Account and is shared by every Region in it. It has no
+ * Region of its own to derive `aws:RequestedRegion` from. A simulated service
+ * has one. It is built for a single Account and Region, and answers only the
+ * requests made to that Region. Carrying that Region into each authorization
+ * request is what lets a service control policy confine an Account to a list
+ * of Regions.
+ *
+ * A service wraps its IAM in this once, where it is wired up, and its
+ * authorization call sites go on saying nothing about the Region. A request
+ * that already names one keeps it, and that is how a service authorizes on
+ * behalf of another Region.
+ */
+class SimIamRegionAuthZ {
+    iam;
+    regionName;
+    constructor(iam, regionName) {
+        this.iam = iam;
+        this.regionName = regionName;
+    }
+    /**
+     * Evaluate an authorization request made in this Region.
+     */
+    authorize(input) {
+        return this.iam.authorize({
+            ...input,
+            region: input.region ?? this.regionName,
+        });
+    }
+}
+/**
+ * The IAM one simulated service authorizes against, bound to its Region.
+ *
+ * A service is built for one Account and Region, and this is where it tells
+ * IAM which. A service built without IAM (a service constructed on its own,
+ * outside a simulation) gets the permissive fallback it has always had, bound
+ * to the same Region.
+ */
+export function simIamInRegion(iam, regionName) {
+    return new SimIamRegionAuthZ(iam ?? new SimIamAllowAllAuth(), regionName);
+}
+/**
+ * The IAM deciding the requests made to one Account and Region scope.
+ *
+ * A service reaching into another scope authorizes there. Both the IAM and
+ * the Region come from the scope being reached into, wherever the request
+ * came from. This is what a scheduled invocation, an event delivery and an
+ * HTTP request served on a function's behalf all decide against.
+ */
+export function simScopeIamAuthZ(scope) {
+    return simIamInRegion(scope.iam(), scope.accountRegionScope.regionName);
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statement.type.d.ts

@@ -0,0 +1,31 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySourceType } from "../context/sim-iam-auth-z-context.js";
+/**
+ * One policy statement an authorization decision could not evaluate.
+ *
+ * The statement applied to the request as far as the simulator could tell:
+ * its Principal, Action and Resource all matched, and only its Condition was
+ * left undecided. Sim IAM fails closed, and the statement matched nothing. A
+ * Deny that would have stopped the request in a real account lets it through
+ * here.
+ *
+ * That is why this is recorded. A decision reporting an ordinary Allow over a
+ * statement nothing could read is an allow for the wrong reason, and a test
+ * asserting on it needs somewhere to find that out.
+ */
+export interface SimIamUnevaluatedStatement {
+    /**
+     * The policy the statement came from.
+     *
+     * This is the policy's name, falling back to the ARN of the resource
+     * holding it, and then to how the policy reached the request, since a
+     * resource policy supplied by a service need not name itself.
+     */
+    readonly policy: string;
+    /** Where the policy came from, e.g. `service-control`. */
+    readonly sourceType: SimIamAuthZPolicySourceType;
+    /** The statement, as its policy document declared it. */
+    readonly statement: SimIamPolicyDocumentStatement;
+    /** Why the simulator could not tell whether the statement matched. */
+    readonly reason: string;
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statement.type.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statements.d.ts

@@ -0,0 +1,31 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamUnevaluatedStatement } from "./sim-iam-unevaluated-statement.type.js";
+/**
+ * The statements one authorization decision could not evaluate.
+ *
+ * Sim IAM implements the condition operators multi-service tests need and
+ * fails closed on the rest, which leaves a statement it cannot read matching
+ * nothing. On a Deny that reads as an allow, and the decision otherwise looks
+ * healthy. Collecting the skips here is what lets a decision say that it
+ * reached its answer without reading everything the policies said.
+ *
+ * A statement recorded twice is kept once. One policy attached at two levels
+ * of an organization is one statement going unread, however many levels
+ * reached it.
+ */
+export declare class SimIamUnevaluatedStatements {
+    private readonly records;
+    /**
+     * Every statement left unevaluated, in the order they were reached.
+     */
+    get all(): readonly SimIamUnevaluatedStatement[];
+    /**
+     * Record a statement the simulator could not decide.
+     */
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, reason: string): void;
+    /**
+     * What to call the policy a statement came from.
+     */
+    private policyName;
+}

package/dist/service/iam/authorize/unevaluated/sim-iam-unevaluated-statements.js

@@ -0,0 +1,43 @@
+/**
+ * The statements one authorization decision could not evaluate.
+ *
+ * Sim IAM implements the condition operators multi-service tests need and
+ * fails closed on the rest, which leaves a statement it cannot read matching
+ * nothing. On a Deny that reads as an allow, and the decision otherwise looks
+ * healthy. Collecting the skips here is what lets a decision say that it
+ * reached its answer without reading everything the policies said.
+ *
+ * A statement recorded twice is kept once. One policy attached at two levels
+ * of an organization is one statement going unread, however many levels
+ * reached it.
+ */
+export class SimIamUnevaluatedStatements {
+    records = [];
+    /**
+     * Every statement left unevaluated, in the order they were reached.
+     */
+    get all() {
+        return this.records;
+    }
+    /**
+     * Record a statement the simulator could not decide.
+     */
+    record(policy, statement, reason) {
+        const already = this.records.some((record) => record.statement === statement && record.reason === reason);
+        if (already) {
+            return;
+        }
+        this.records.push({
+            policy: this.policyName(policy),
+            sourceType: policy.sourceType,
+            statement,
+            reason,
+        });
+    }
+    /**
+     * What to call the policy a statement came from.
+     */
+    policyName(policy) {
+        return policy.policyName ?? policy.resourceArn ?? policy.sourceType;
+    }
+}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts

@@ -3,6 +3,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamManagedPolicyAttacherProperties {
     readonly iam: SimIam;
 }
@@ -32,7 +33,7 @@ export declare class SimCfnIamManagedPolicyAttacher {
     /**
      * Attach the created Managed Policy to each of the Roles.
      */
-    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[]): Promise<void>;
+    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[], options: SimCfnResourceCallerOptions): Promise<void>;
     private roleName;
     private rejectUnsimulatedPrincipals;
 }

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js

@@ -37,10 +37,8 @@ export class SimCfnIamManagedPolicyAttacher {
     /**
      * Attach the created Managed Policy to each of the Roles.
      */
-    async attach(policyArn, roleNames) {
-        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({
-            input: { RoleName: roleName, PolicyArn: policyArn },
-        })));
+    async attach(policyArn, roleNames, options) {
+        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({ input: { RoleName: roleName, PolicyArn: policyArn } }, options)));
     }
     roleName(resource, roleName) {
         if (typeof roleName !== "string") {

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamManagedPolicy } from "../../policy/sim-iam-policy.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamManagedPolicyCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamManagedPolicyCreator {
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamManagedPolicy>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamManagedPolicy>;
     private managedPolicyName;
     private path;
     private description;

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -13,7 +13,7 @@ export class SimCfnIamManagedPolicyCreator {
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const roleNames = this.attacher.roleNames(resource, properties);
         const policyName = this.managedPolicyName(resource, properties);
         const path = this.path(resource, properties);
@@ -26,10 +26,10 @@ export class SimCfnIamManagedPolicyCreator {
                 Description: description,
                 PolicyDocument: policyDocument,
             },
-        });
+        }, options);
         const policy = this.iam.policies.get(policyCreation.Policy.Arn);
         assertDefined(policy, `Sim IAM Managed Policy ${policyCreation.Policy.Arn} after CloudFormation creation`);
-        await this.attacher.attach(policy.arn, roleNames);
+        await this.attacher.attach(policy.arn, roleNames, options);
         return policy;
     }
     managedPolicyName(resource, properties) {

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamPolicyCreatorProperties {
     readonly iam: SimIam;
 }
@@ -22,7 +23,7 @@ export declare class SimCfnIamPolicyCreator {
     /**
      * Put the inline policy onto each referenced Role and User.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<undefined>;
     private putRolePolicies;
     private putUserPolicies;
 }

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -19,30 +19,30 @@ export class SimCfnIamPolicyCreator {
     /**
      * Put the inline policy onto each referenced Role and User.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const policyProperties = this.propsParser.parse(resource, properties);
         await Promise.all([
-            this.putRolePolicies(policyProperties),
-            this.putUserPolicies(policyProperties),
+            this.putRolePolicies(policyProperties, options),
+            this.putUserPolicies(policyProperties, options),
         ]);
         return undefined;
     }
-    async putRolePolicies(policyProperties) {
+    async putRolePolicies(policyProperties, options) {
         await Promise.all(policyProperties.roleNames.map(async (roleName) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleName,
                 PolicyName: policyProperties.policyName,
                 PolicyDocument: policyProperties.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async putUserPolicies(policyProperties) {
+    async putUserPolicies(policyProperties, options) {
         await Promise.all(policyProperties.usernames.map(async (username) => this.iam.putUserPolicy({
             input: {
                 UserName: username,
                 PolicyName: policyProperties.policyName,
                 PolicyDocument: policyProperties.policyDocument,
             },
-        })));
+        }, options)));
     }
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamRole } from "../../role/sim-iam-role.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamRoleCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamRoleCreator {
     /**
      * Create a simulated Role from an AWS::IAM::Role Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamRole>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamRole>;
     private putInlinePolicies;
     private attachManagedPolicies;
 }