@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js

@@ -12,7 +12,7 @@ export class SimCfnIamRoleCreator {
     /**
      * Create a simulated Role from an AWS::IAM::Role Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const roleProperties = this.propsParser.parse(resource, properties);
         await this.iam.createRole({
             input: {
@@ -21,30 +21,30 @@ export class SimCfnIamRoleCreator {
                 Description: roleProperties.description,
                 AssumeRolePolicyDocument: roleProperties.assumeRolePolicyDocument,
             },
-        });
+        }, options);
         await Promise.all([
-            this.putInlinePolicies(roleProperties),
-            this.attachManagedPolicies(roleProperties),
+            this.putInlinePolicies(roleProperties, options),
+            this.attachManagedPolicies(roleProperties, options),
         ]);
         const role = this.iam.roles.get(roleProperties.roleName);
         assertDefined(role, `Sim IAM Role ${roleProperties.roleName} after CloudFormation creation`);
         return role;
     }
-    async putInlinePolicies(roleProperties) {
+    async putInlinePolicies(roleProperties, options) {
         await Promise.all(roleProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleProperties.roleName,
                 PolicyName: inlinePolicy.policyName,
                 PolicyDocument: inlinePolicy.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async attachManagedPolicies(roleProperties) {
+    async attachManagedPolicies(roleProperties, options) {
         await Promise.all(roleProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachRolePolicy({
             input: {
                 RoleName: roleProperties.roleName,
                 PolicyArn: policyArn,
             },
-        })));
+        }, options)));
     }
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamRoleDeleterProperties {
     readonly iam: SimIam;
 }
@@ -22,7 +23,7 @@ export declare class SimCfnIamRoleDeleter {
     /**
      * Delete the Role a CloudFormation Resource created.
      */
-    delete(resource: SimCfnResource): Promise<void>;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
     private detachPolicies;
     private deleteInlinePolicies;
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-deleter.js

@@ -20,21 +20,19 @@ export class SimCfnIamRoleDeleter {
     /**
      * Delete the Role a CloudFormation Resource created.
      */
-    async delete(resource) {
+    async delete(resource, options) {
         const role = resource.simResource;
         assertDefined(role, `sim IAM Role for CloudFormation Resource ${resource.logicalId}`);
-        await this.detachPolicies(role);
-        await this.deleteInlinePolicies(role);
-        await this.iam.deleteRole({ input: { RoleName: role.roleName } });
+        await this.detachPolicies(role, options);
+        await this.deleteInlinePolicies(role, options);
+        await this.iam.deleteRole({ input: { RoleName: role.roleName } }, options);
     }
-    async detachPolicies(role) {
-        await Promise.all([...role.attachedPolicyArns].map(async (policyArn) => this.iam.detachRolePolicy({
-            input: { RoleName: role.roleName, PolicyArn: policyArn },
-        })));
+    async detachPolicies(role, options) {
+        await Promise.all([...role.attachedPolicyArns].map(async (policyArn) => this.iam.detachRolePolicy({ input: { RoleName: role.roleName, PolicyArn: policyArn } }, options)));
     }
-    async deleteInlinePolicies(role) {
-        await Promise.all(role.inlinePolicies.keys().map(async (policyName) => this.iam.deleteRolePolicy({
-            input: { RoleName: role.roleName, PolicyName: policyName },
-        })));
+    async deleteInlinePolicies(role, options) {
+        await Promise.all(role.inlinePolicies
+            .keys()
+            .map(async (policyName) => this.iam.deleteRolePolicy({ input: { RoleName: role.roleName, PolicyName: policyName } }, options)));
     }
 }

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamResourceDeleterProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamResourceDeleter {
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     private deleteManagedPolicy;
     /**
      * Take the Managed Policy off every Role still carrying it.

package/dist/service/iam/cfn/sim-cfn-iam-resource-deleter.js

@@ -16,22 +16,22 @@ export class SimCfnIamResourceDeleter {
     /**
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                await this.deleteManagedPolicy(resource);
+                await this.deleteManagedPolicy(resource, options);
                 return;
             }
             case "Policy": {
-                await this.deleteInlinePolicy(properties);
+                await this.deleteInlinePolicy(properties, options);
                 return;
             }
             case "Role": {
-                await this.roleDeleter.delete(resource);
+                await this.roleDeleter.delete(resource, options);
                 return;
             }
             case "User": {
-                await this.userDeleter.delete(resource);
+                await this.userDeleter.delete(resource, options);
                 return;
             }
             default: {
@@ -39,11 +39,11 @@ export class SimCfnIamResourceDeleter {
             }
         }
     }
-    async deleteManagedPolicy(resource) {
+    async deleteManagedPolicy(resource, options) {
         const policy = resource.simResource;
         assertDefined(policy, `sim IAM Managed Policy for CloudFormation Resource ${resource.logicalId}`);
-        await this.detachManagedPolicy(policy.arn);
-        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } });
+        await this.detachManagedPolicy(policy.arn, options);
+        await this.iam.deletePolicy({ input: { PolicyArn: policy.arn } }, options);
     }
     /**
      * Take the Managed Policy off every Role still carrying it.
@@ -54,13 +54,11 @@ export class SimCfnIamResourceDeleter {
      * Resource is deleted. A Role declared outside the Stack keeps it. This
      * clears whatever attachments are left either way.
      */
-    async detachManagedPolicy(policyArn) {
+    async detachManagedPolicy(policyArn, options) {
         await Promise.all(this.iam.roles
             .values()
             .filter((role) => role.attachedPolicyArns.has(policyArn))
-            .map(async (role) => this.iam.detachRolePolicy({
-            input: { RoleName: role.roleName, PolicyArn: policyArn },
-        })));
+            .map(async (role) => this.iam.detachRolePolicy({ input: { RoleName: role.roleName, PolicyArn: policyArn } }, options)));
     }
     /**
      * Take an AWS::IAM::Policy back off the Roles it was put on.
@@ -69,7 +67,7 @@ export class SimCfnIamResourceDeleter {
      * the template the same way creation read them. Their Refs still resolve,
      * because a Role is deleted after the policies naming it.
      */
-    async deleteInlinePolicy(properties) {
+    async deleteInlinePolicy(properties, options) {
         const policyName = properties["PolicyName"];
         const roles = properties["Roles"];
         /* v8 ignore if -- creation refused the Resource if either was missing */
@@ -78,8 +76,6 @@ export class SimCfnIamResourceDeleter {
         }
         await Promise.all(roles
             .filter((roleName) => typeof roleName === "string")
-            .map(async (roleName) => this.iam.deleteRolePolicy({
-            input: { RoleName: roleName, PolicyName: policyName },
-        })));
+            .map(async (roleName) => this.iam.deleteRolePolicy({ input: { RoleName: roleName, PolicyName: policyName } }, options)));
     }
 }

package/dist/service/iam/cfn/sim-cfn-iam-resource-factory.js

@@ -3,6 +3,7 @@ import { SimCfnIamPolicyCreator } from "./policy/sim-cfn-iam-policy-creator.js";
 import { SimCfnIamRoleCreator } from "./role/sim-cfn-iam-role-creator.js";
 import { SimCfnIamUserCreator } from "./user/sim-cfn-iam-user-creator.js";
 import { SimCfnIamResourceDeleter } from "./sim-cfn-iam-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated IAM resources.
  */
@@ -23,19 +24,21 @@ export class SimIamCloudFormationResourceFactory {
      * Create a simulated IAM resource from a CloudFormation Resource.
      */
     async create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "ManagedPolicy": {
-                return await this.managedPolicyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.managedPolicyCreator.create(resource, properties, options);
             }
             case "Policy": {
-                await this.policyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                await this.policyCreator.create(resource, properties, options);
                 return;
             }
             case "Role": {
-                return await this.roleCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.roleCreator.create(resource, properties, options);
             }
             case "User": {
-                return await this.userCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.userCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim IAM CloudFormation Resource ${resourceTypeName}`);
@@ -46,6 +49,6 @@ export class SimIamCloudFormationResourceFactory {
      * Delete a simulated IAM resource created from a CloudFormation Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimIam } from "../../sim-iam.js";
 import type { SimIamUser } from "../../user/sim-iam-user.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserCreatorProperties {
     readonly iam: SimIam;
 }
@@ -15,7 +16,7 @@ export declare class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamUser>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimIamUser>;
     private putInlinePolicies;
     private attachManagedPolicies;
     /**

package/dist/service/iam/cfn/user/sim-cfn-iam-user-creator.js

@@ -12,45 +12,45 @@ export class SimCfnIamUserCreator {
     /**
      * Create a simulated User from an AWS::IAM::User Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const userProperties = this.propsParser.parse(resource, properties);
         await this.iam.createUser({
             input: {
                 UserName: userProperties.userName,
                 Path: userProperties.path,
             },
-        });
+        }, options);
         await Promise.all([
-            this.putInlinePolicies(userProperties),
-            this.attachManagedPolicies(userProperties),
-            this.createLoginProfile(userProperties),
+            this.putInlinePolicies(userProperties, options),
+            this.attachManagedPolicies(userProperties, options),
+            this.createLoginProfile(userProperties, options),
         ]);
         const user = this.iam.users.get(userProperties.userName);
         assertDefined(user, `Sim IAM User ${userProperties.userName} after CloudFormation creation`);
         return user;
     }
-    async putInlinePolicies(userProperties) {
+    async putInlinePolicies(userProperties, options) {
         await Promise.all(userProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyName: inlinePolicy.policyName,
                 PolicyDocument: inlinePolicy.policyDocument,
             },
-        })));
+        }, options)));
     }
-    async attachManagedPolicies(userProperties) {
+    async attachManagedPolicies(userProperties, options) {
         await Promise.all(userProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachUserPolicy({
             input: {
                 UserName: userProperties.userName,
                 PolicyArn: policyArn,
             },
-        })));
+        }, options)));
     }
     /**
      * Give the User a console password, the way real CloudFormation calls
      * CreateLoginProfile for a `LoginProfile` property.
      */
-    async createLoginProfile(userProperties) {
+    async createLoginProfile(userProperties, options) {
         const { loginProfile } = userProperties;
         if (loginProfile === undefined) {
             return;
@@ -61,6 +61,6 @@ export class SimCfnIamUserCreator {
                 Password: loginProfile.password,
                 PasswordResetRequired: loginProfile.passwordResetRequired,
             },
-        });
+        }, options);
     }
 }

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimIam } from "../../sim-iam.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnIamUserDeleterProperties {
     readonly iam: SimIam;
 }
@@ -12,7 +13,8 @@ interface SimCfnIamUserDeleterProperties {
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export declare class SimCfnIamUserDeleter {
     private readonly iam;
@@ -20,6 +22,6 @@ export declare class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    delete(resource: SimCfnResource): Promise<void>;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/iam/cfn/user/sim-cfn-iam-user-deleter.js

@@ -8,7 +8,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
  * is detached and a `Policies` entry removed as part of deleting the User.
  *
  * Sim IAM serves no DeleteUserPolicy or DetachUserPolicy, so both come off the
- * User record here rather than through a command.
+ * User record here rather than through a command. A DeleteUser the caller is
+ * not allowed puts them back, leaving the User as the Stack deployed it.
  */
 export class SimCfnIamUserDeleter {
     iam;
@@ -18,11 +19,24 @@ export class SimCfnIamUserDeleter {
     /**
      * Delete the User a CloudFormation Resource created.
      */
-    async delete(resource) {
+    async delete(resource, options) {
         const user = resource.simResource;
         assertDefined(user, `sim IAM User for CloudFormation Resource ${resource.logicalId}`);
+        const attachedPolicyArns = [...user.attachedPolicyArns];
+        const inlinePolicies = [...user.inlinePolicies];
         user.attachedPolicyArns.clear();
         user.inlinePolicies.clear();
-        await this.iam.deleteUser({ input: { UserName: user.userName } });
+        try {
+            await this.iam.deleteUser({ input: { UserName: user.userName } }, options);
+        }
+        catch (error) {
+            for (const policyArn of attachedPolicyArns) {
+                user.attachedPolicyArns.add(policyArn);
+            }
+            for (const [policyName, document] of inlinePolicies) {
+                user.inlinePolicies.set(policyName, document);
+            }
+            throw error;
+        }
     }
 }

package/dist/service/iam/command/policy/create-policy/create-policy-input-resolver.js

@@ -26,7 +26,10 @@ export class CreatePolicyInputResolver {
         if (policyName === undefined || policyName.length === 0) {
             throw new Error("PolicyName is required");
         }
-        this.policyDocValidator.validateOptional(command.input.PolicyDocument);
+        this.policyDocValidator.validateOptional(command.input.PolicyDocument, {
+            attachedTo: "Policy",
+            name: policyName,
+        });
         const path = normalisePolicyPath(command.input.Path);
         const arn = makeSimPolicyArn({
             accountId: this.accountId,

package/dist/service/iam/command/policy/put-role-policy/put-role-policy.handler.js

@@ -33,7 +33,11 @@ export class PutRolePolicyCommandHandler {
             throw new Error("PolicyName is required");
         }
         const policyDocument = command.input.PolicyDocument;
-        this.policyDocValidator.validateRequired(policyDocument);
+        this.policyDocValidator.validateRequired(policyDocument, {
+            attachedTo: "Role",
+            name: roleName,
+            policyName,
+        });
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const role = this.roles.get(roleName);

package/dist/service/iam/command/policy/put-user-policy/put-user-policy.handler.js

@@ -29,7 +29,11 @@ export class PutUserPolicyCommandHandler {
         const policyName = command.input.PolicyName;
         assertDefined(policyName, "PutUserPolicyCommand.input.PolicyName");
         const policyDocument = command.input.PolicyDocument;
-        this.policyDocValidator.validateRequired(policyDocument);
+        this.policyDocValidator.validateRequired(policyDocument, {
+            attachedTo: "User",
+            name: username,
+            policyName,
+        });
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const user = this.users.get(username);

package/dist/service/iam/command/sim-iam-command-handlers.js

@@ -1,4 +1,5 @@
 import { SimIamActionAuthorizer } from "../authorize/sim-iam-action-authorizer.js";
+import { simIamGlobalServiceRegion, simIamInRegion, } from "../authorize/sim-iam-region-auth-z.js";
 import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
 import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
 import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
@@ -15,7 +16,11 @@ export class SimIamCommandHandlers {
     users;
     policies;
     constructor(properties) {
-        const authorizer = new SimIamActionAuthorizer({ iam: properties.iam });
+        // IAM is global rather than Region-scoped, so its own control-plane
+        // requests are made in the Region its one endpoint is in.
+        const authorizer = new SimIamActionAuthorizer({
+            iam: simIamInRegion(properties.iam, simIamGlobalServiceRegion),
+        });
         this.roles = new SimIamRoleCommandHandlers({
             accountId: properties.accountId,
             roles: properties.roles,

package/dist/service/iam/policy/parse/sim-iam-document-parser.d.ts

@@ -19,6 +19,10 @@ export interface SimIamParsedPolicyStatement {
  *
  * IAM policy JSON commonly allows either a single value or an array. The decision
  * engine should not need to care which source shape was used.
+ *
+ * A document stored without validation can hold a value of the wrong type in
+ * one of those fields. Parsing it reports a malformed policy naming the
+ * statement.
  */
 export declare class SimIamPolicyDocumentParser {
     /**
@@ -26,5 +30,4 @@ export declare class SimIamPolicyDocumentParser {
      */
     parse(policy: SimIamPolicyDocument): SimIamParsedPolicyDocument;
     private parseStatement;
-    private stringList;
 }

package/dist/service/iam/policy/parse/sim-iam-document-parser.js

@@ -1,9 +1,15 @@
 import { simIamPolicyDocumentStatements } from "../sim-iam-pol-document-statements.js";
+import { simIamStatementLabel } from "../sim-iam-statement-label.js";
+import { simIamStatementStrings } from "../sim-iam-statement-strings.js";
 /**
  * Parse raw IAM policy document shapes into a form convenient for evaluation.
  *
  * IAM policy JSON commonly allows either a single value or an array. The decision
  * engine should not need to care which source shape was used.
+ *
+ * A document stored without validation can hold a value of the wrong type in
+ * one of those fields. Parsing it reports a malformed policy naming the
+ * statement.
  */
 export class SimIamPolicyDocumentParser {
     /**
@@ -11,30 +17,22 @@ export class SimIamPolicyDocumentParser {
      */
     parse(policy) {
         return {
-            statements: simIamPolicyDocumentStatements(policy).map((statement) => this.parseStatement(statement)),
+            statements: simIamPolicyDocumentStatements(policy).map((statement, index) => this.parseStatement(statement, index)),
         };
     }
-    parseStatement(statement) {
+    parseStatement(statement, index) {
+        const label = simIamStatementLabel(index);
         return {
             source: statement,
             sid: statement.Sid,
             effect: statement.Effect,
-            actions: this.stringList(statement.Action),
-            notActions: this.stringList(statement.NotAction),
-            resources: this.stringList(statement.Resource),
-            notResources: this.stringList(statement.NotResource),
+            actions: simIamStatementStrings(statement.Action, label, "Action"),
+            notActions: simIamStatementStrings(statement.NotAction, label, "NotAction"),
+            resources: simIamStatementStrings(statement.Resource, label, "Resource"),
+            notResources: simIamStatementStrings(statement.NotResource, label, "NotResource"),
             principal: statement.Principal,
             notPrincipal: statement.NotPrincipal,
             condition: statement.Condition,
         };
     }
-    stringList(value) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value === "string") {
-            return [value];
-        }
-        return [...value];
-    }
 }

package/dist/service/iam/policy/sim-iam-statement-label.d.ts

@@ -0,0 +1,28 @@
+/**
+ * What a policy document is attached to, for naming it when one of its
+ * statements is rejected.
+ */
+export interface SimIamPolicyDocumentSubject {
+    /**
+     * The kind of thing the document is attached to, such as `Role` or `Bucket`.
+     */
+    readonly attachedTo: string;
+    /**
+     * The name of the thing the document is attached to.
+     */
+    readonly name: string;
+    /**
+     * The policy's own name, for a document stored under one.
+     */
+    readonly policyName?: string | undefined;
+}
+/**
+ * Name one statement of a policy document, for a message about what is wrong
+ * with it.
+ *
+ * A malformed statement usually arrives from a CloudFormation template. The
+ * reader chasing one back needs the document it came from as well as the fault
+ * in it. Statements carry no names of their own. The position in the document
+ * stands in for one.
+ */
+export declare function simIamStatementLabel(index: number, subject?: SimIamPolicyDocumentSubject): string;

package/dist/service/iam/policy/sim-iam-statement-label.js

@@ -0,0 +1,17 @@
+/**
+ * Name one statement of a policy document, for a message about what is wrong
+ * with it.
+ *
+ * A malformed statement usually arrives from a CloudFormation template. The
+ * reader chasing one back needs the document it came from as well as the fault
+ * in it. Statements carry no names of their own. The position in the document
+ * stands in for one.
+ */
+export function simIamStatementLabel(index, subject) {
+    const statement = `statement ${index + 1}`;
+    if (subject === undefined) {
+        return `IAM policy ${statement}`;
+    }
+    const policy = subject.policyName === undefined ? "" : ` policy "${subject.policyName}"`;
+    return `${subject.attachedTo} "${subject.name}"${policy} ${statement}`;
+}

package/dist/service/iam/policy/sim-iam-statement-strings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read a statement field holding either one string or a list of strings.
+ *
+ * Action, NotAction, Resource and NotResource each take either shape, and
+ * anything else is a malformed document. An unresolved CloudFormation intrinsic
+ * is the usual way one arrives. The IAM policy parsers store `PolicyDocument`
+ * whole, and a `Ref` or `Fn::GetAtt` nested inside a statement is kept as
+ * written. Refusing it here keeps it out of evaluation, where the same value
+ * surfaces as a `TypeError` naming no policy.
+ */
+export declare function simIamStatementStrings(value: unknown, label: string, field: string): readonly string[] | undefined;

package/dist/service/iam/policy/sim-iam-statement-strings.js

@@ -0,0 +1,27 @@
+import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
+/**
+ * Read a statement field holding either one string or a list of strings.
+ *
+ * Action, NotAction, Resource and NotResource each take either shape, and
+ * anything else is a malformed document. An unresolved CloudFormation intrinsic
+ * is the usual way one arrives. The IAM policy parsers store `PolicyDocument`
+ * whole, and a `Ref` or `Fn::GetAtt` nested inside a statement is kept as
+ * written. Refusing it here keeps it out of evaluation, where the same value
+ * surfaces as a `TypeError` naming no policy.
+ */
+export function simIamStatementStrings(value, label, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (isStringArray(value)) {
+        return [...value];
+    }
+    throw new SimIamMalformedPolicyDocument(`${label}: ${field} must be a string or an array of strings, but holds ${JSON.stringify(value)}`);
+}
+function isStringArray(value) {
+    return (Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string"));
+}

package/dist/service/iam/validate/sim-iam-policy-document-validator.d.ts

@@ -1,17 +1,24 @@
 import { type JSONString } from "../../../util/type-guard/json.js";
 import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+import { type SimIamPolicyDocumentSubject } from "../policy/sim-iam-statement-label.js";
 /**
  * Performs basic IAM policy document validation shared by IAM policy commands.
+ *
+ * A caller can say what the document is attached to, and a rejection names it.
+ * Malformed documents usually arrive from a CloudFormation template, and the
+ * failure has to carry enough for a reader to find the template that wrote
+ * it.
  */
 export declare class SimIamPolicyDocumentValidator {
     /**
      * Validate a required JSON IAM policy document string.
      */
-    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    validateRequired(policyDocument: string | undefined, subject?: SimIamPolicyDocumentSubject): asserts policyDocument is JSONString<SimIamPolicyDocument>;
     /**
      * Validate an optional JSON IAM policy document string when present.
      */
-    validateOptional(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
+    validateOptional(policyDocument: string | undefined, subject?: SimIamPolicyDocumentSubject): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
     private validate;
     private validateParsed;
+    private validateStatement;
 }