@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/iam/validate/sim-iam-policy-document-validator.js

@@ -1,45 +1,63 @@
 import { jsonParse } from "../../../util/type-guard/json.js";
 import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
 import { simIamPolicyDocumentStatements } from "../policy/sim-iam-pol-document-statements.js";
+import { simIamStatementLabel, } from "../policy/sim-iam-statement-label.js";
+import { simIamStatementStrings } from "../policy/sim-iam-statement-strings.js";
 /**
  * Performs basic IAM policy document validation shared by IAM policy commands.
+ *
+ * A caller can say what the document is attached to, and a rejection names it.
+ * Malformed documents usually arrive from a CloudFormation template, and the
+ * failure has to carry enough for a reader to find the template that wrote
+ * it.
  */
 export class SimIamPolicyDocumentValidator {
     /**
      * Validate a required JSON IAM policy document string.
      */
-    validateRequired(policyDocument) {
+    validateRequired(policyDocument, subject) {
         if (policyDocument === undefined || policyDocument.length === 0) {
             throw new Error("PolicyDocument is required");
         }
-        this.validate(policyDocument);
+        this.validate(policyDocument, subject);
     }
     /**
      * Validate an optional JSON IAM policy document string when present.
      */
-    validateOptional(policyDocument) {
+    validateOptional(policyDocument, subject) {
         if (policyDocument === undefined || policyDocument.length === 0) {
             return;
         }
-        this.validate(policyDocument);
+        this.validate(policyDocument, subject);
     }
-    validate(policyDocument) {
+    validate(policyDocument, subject) {
         const parsedPolicyDocument = jsonParse(policyDocument);
-        this.validateParsed(parsedPolicyDocument);
+        this.validateParsed(parsedPolicyDocument, subject);
     }
-    validateParsed(policyDocument) {
-        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
-            // oxlint-disable-next-line typescript/no-unnecessary-condition
-            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
-                throw new SimIamMalformedPolicyDocument('IAM policy statement Effect must be either "Allow" or "Deny"');
-            }
-            if (statement.Action === undefined && statement.NotAction === undefined) {
-                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Action or NotAction");
-            }
-            if (statement.Resource === undefined &&
-                statement.NotResource === undefined) {
-                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Resource or NotResource");
-            }
+    validateParsed(policyDocument, subject) {
+        const statements = simIamPolicyDocumentStatements(policyDocument);
+        for (const [index, statement] of statements.entries()) {
+            this.validateStatement(statement, simIamStatementLabel(index, subject));
         }
     }
+    validateStatement(statement, label) {
+        // oxlint-disable-next-line typescript/no-unnecessary-condition
+        if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+            throw new SimIamMalformedPolicyDocument(`${label}: Effect must be either "Allow" or "Deny"`);
+        }
+        if (statement.Action === undefined && statement.NotAction === undefined) {
+            throw new SimIamMalformedPolicyDocument(`${label}: must define either Action or NotAction`);
+        }
+        if (statement.Resource === undefined &&
+            statement.NotResource === undefined) {
+            throw new SimIamMalformedPolicyDocument(`${label}: must define either Resource or NotResource`);
+        }
+        // Read for the types alone. A field of the wrong type throws while the
+        // document is still beside the call that wrote it. Left to the first
+        // authorization, the same fault names no policy at all.
+        simIamStatementStrings(statement.Action, label, "Action");
+        simIamStatementStrings(statement.NotAction, label, "NotAction");
+        simIamStatementStrings(statement.Resource, label, "Resource");
+        simIamStatementStrings(statement.NotResource, label, "NotResource");
+    }
 }

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKinesis } from "../sim-kinesis.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisResourceDeleterProperties {
     readonly kinesis: SimKinesis;
 }
@@ -12,6 +13,6 @@ export declare class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-cfn-kinesis-resource-deleter.js

@@ -10,12 +10,12 @@ export class SimCfnKinesisResourceDeleter {
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const stream = resource.simResource;
         assertDefined(stream, `sim Kinesis stream for CloudFormation Resource ${resource.logicalId}`);
-        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } });
+        await this.kinesis.deleteStream({ input: { StreamARN: stream.arn } }, options);
     }
 }

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.d.ts

@@ -25,6 +25,6 @@ export declare class SimKinesisCfnResourceFactory implements SimCfnServiceResour
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kinesis/cfn/sim-kinesis-cfn-resource-factory.js

@@ -1,5 +1,6 @@
 import { SimCfnKinesisResourceDeleter } from "./sim-cfn-kinesis-resource-deleter.js";
 import { SimCfnKinesisStreamCreator } from "./stream/sim-cfn-kinesis-stream-creator.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Kinesis resources.
  */
@@ -27,12 +28,12 @@ export class SimKinesisCfnResourceFactory {
         if (resourceTypeName !== "Stream") {
             throw new Error(`Unsupported sim Kinesis CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.streamCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Kinesis resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKinesis } from "../../sim-kinesis.js";
 import type { SimKinesisStream } from "../../stream/sim-kinesis-stream.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKinesisStreamCreatorProperties {
     readonly kinesis: SimKinesis;
 }
@@ -23,7 +24,7 @@ export declare class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKinesisStream>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKinesisStream>;
     /**
      * Move the stream's retention up to what the template asked for.
      *

package/dist/service/kinesis/cfn/stream/sim-cfn-kinesis-stream-creator.js

@@ -23,7 +23,7 @@ export class SimCfnKinesisStreamCreator {
     /**
      * Create a stream from an AWS::Kinesis::Stream Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const streamProperties = new SimCfnKinesisStreamProperties({
             resource,
             properties,
@@ -43,8 +43,8 @@ export class SimCfnKinesisStreamCreator {
                     }),
                     ...(tags !== undefined && { Tags: tags }),
                 },
-            });
-            await this.applyRetention(name, retentionHours);
+            }, options);
+            await this.applyRetention(name, retentionHours, options);
             const stream = this.kinesis.findStream(name);
             assertDefined(stream, `sim Kinesis stream ${name} after CloudFormation creation`);
             return stream;
@@ -59,13 +59,11 @@ export class SimCfnKinesisStreamCreator {
      * which is just as well: real Kinesis refuses an increase to what the stream
      * already keeps.
      */
-    async applyRetention(name, retentionHours) {
+    async applyRetention(name, retentionHours, options) {
         if (retentionHours === undefined ||
             retentionHours <= simKinesisDefaultRetentionHours) {
             return;
         }
-        await this.kinesis.increaseStreamRetentionPeriod({
-            input: { StreamName: name, RetentionPeriodHours: retentionHours },
-        });
+        await this.kinesis.increaseStreamRetentionPeriod({ input: { StreamName: name, RetentionPeriodHours: retentionHours } }, options);
     }
 }

package/dist/service/kinesis/sim-kinesis.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simKinesisCommands from "./command/sim-kinesis-command.types.js";
 import type { SimKinesisRequestOptions } from "./command/sim-kinesis-request-options.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";

package/dist/service/kinesis/sim-kinesis.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKinesisCommands } from "./command/sim-kinesis-commands.js";
 import { SimKinesisCfnResourceFactory } from "./cfn/sim-kinesis-cfn-resource-factory.js";
 import { SimKinesisSdkCommandRouter } from "./sdk/sim-kinesis-sdk-command-router.js";
@@ -32,7 +32,8 @@ export class SimKinesis {
         kinesis: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
         this.commands = new SimKinesisCommands({
             streams: this.streams,

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsAlias } from "../../key/sim-kms-alias.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsAliasCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,6 +20,6 @@ export declare class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsAlias>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsAlias>;
 }
 export {};

package/dist/service/kms/cfn/alias/sim-cfn-kms-alias-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsAliasCreator {
     /**
      * Create an alias from an AWS::KMS::Alias Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const aliasProperties = new SimCfnKmsAliasProperties({
             resource,
             properties,
@@ -27,7 +27,7 @@ export class SimCfnKmsAliasCreator {
                 AliasName: aliasName,
                 TargetKeyId: aliasProperties.targetKeyId(),
             },
-        });
+        }, options);
         const alias = this.kms.findAlias(aliasName);
         assertDefined(alias, `sim KMS alias ${aliasName} after CloudFormation creation`);
         return alias;

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimKmsKey } from "../../key/sim-kms-key.js";
 import type { SimKms } from "../../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsKeyCreatorProperties {
     readonly kms: SimKms;
 }
@@ -19,16 +20,15 @@ export declare class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimKmsKey>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimKmsKey>;
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
     private applyEnabled;
 }

package/dist/service/kms/cfn/key/sim-cfn-kms-key-creator.js

@@ -16,7 +16,7 @@ export class SimCfnKmsKeyCreator {
     /**
      * Create a key from an AWS::KMS::Key Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const keyProperties = new SimCfnKmsKeyProperties({ resource, properties });
         const created = await this.kms.createKey({
             input: {
@@ -26,27 +26,27 @@ export class SimCfnKmsKeyCreator {
                 KeyUsage: keyProperties.keyUsage(),
                 Origin: keyProperties.origin(),
             },
-        });
+        }, options);
         const keyId = created.KeyMetadata?.KeyId;
         assertDefined(keyId, `sim KMS key ID after CloudFormation creation for ${resource.logicalId}`);
         const key = this.kms.findKey(keyId);
         assertDefined(key, `sim KMS key ${keyId} after CloudFormation creation`);
-        this.applyEnabled(key, keyProperties.enabled());
+        await this.applyEnabled(keyId, keyProperties.enabled(), options);
         return key;
     }
     /**
      * Apply `Enabled: false`, which asks for a key that is disabled the moment
      * it exists.
      *
-     * CreateKey has no input for that, as the real API has none either: real
-     * CloudFormation makes the key and then disables it. The key model is
-     * disabled directly rather than through DisableKey, because CloudFormation
-     * is acting as the key's creator here and has no caller identity of its own
-     * to authorize.
+     * CreateKey has no input for that, as the real API has none either. Real
+     * CloudFormation makes the key and then disables it, and this goes through
+     * DisableKey for the same reason, so a deployment allowed to make keys and
+     * not to disable them is refused here rather than quietly disabling one.
      */
-    applyEnabled(key, enabled) {
-        if (!enabled) {
-            key.disable();
+    async applyEnabled(keyId, enabled, options) {
+        if (enabled) {
+            return;
         }
+        await this.kms.disableKey({ input: { KeyId: keyId } }, options);
     }
 }

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnKmsResourceDeleterProperties {
     readonly kms: SimKms;
 }
@@ -17,6 +18,6 @@ export declare class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-deleter.js

@@ -15,20 +15,18 @@ export class SimCfnKmsResourceDeleter {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         switch (resourceTypeName) {
             case "Key": {
                 const key = resource.simResource;
                 assertDefined(key, `sim KMS Key for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } });
+                await this.kms.scheduleKeyDeletion({ input: { KeyId: key.keyId } }, options);
                 return;
             }
             case "Alias": {
                 const alias = resource.simResource;
                 assertDefined(alias, `sim KMS Alias for CloudFormation Resource ${resource.logicalId}`);
-                await this.kms.deleteAlias({
-                    input: { AliasName: alias.aliasName },
-                });
+                await this.kms.deleteAlias({ input: { AliasName: alias.aliasName } }, options);
                 return;
             }
             default: {

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimKms } from "../sim-kms.js";
+import type { SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.type.js";
 interface SimKmsCfnResourceFactoryProperties {
     readonly kms: SimKms;
 }
@@ -22,6 +23,6 @@ export declare class SimKmsCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnKmsAliasCreator } from "./alias/sim-cfn-kms-alias-creator.js";
 import { SimCfnKmsKeyCreator } from "./key/sim-cfn-kms-key-creator.js";
 import { SimCfnKmsResourceDeleter } from "./sim-cfn-kms-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated KMS resources.
  */
@@ -21,12 +22,13 @@ export class SimKmsCfnResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "Key": {
-                return await this.keyCreator.create(resource, properties);
+                return await this.keyCreator.create(resource, properties, options);
             }
             case "Alias": {
-                return await this.aliasCreator.create(resource, properties);
+                return await this.aliasCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim KMS CloudFormation Resource ${resourceTypeName}`);
@@ -36,7 +38,7 @@ export class SimKmsCfnResourceFactory {
     /**
      * Delete a simulated KMS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
-        await this.deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/kms/sim-kms-commands.d.ts

@@ -1,6 +1,6 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimKmsAliasCommands } from "./command/alias/sim-kms-alias-commands.js";
 import { SimKmsCryptoCommands } from "./command/crypto/sim-kms-crypto-commands.js";
 import { SimKmsGenerateDataKey } from "./command/crypto/sim-kms-generate-data-key.js";

package/dist/service/kms/sim-kms-commands.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKmsAliasCommands } from "./command/alias/sim-kms-alias-commands.js";
 import { SimKmsAuthorizer } from "./command/authorize/sim-kms-authorizer.js";
 import { SimKmsCryptoCommands } from "./command/crypto/sim-kms-crypto-commands.js";
@@ -33,7 +33,8 @@ export class SimKmsCommands {
     generateDataKey;
     background;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const keyFactory = new SimKmsKeyFactory({
             accountRegionScope,
             clock: background,

package/dist/service/lambda/cfn/alias/sim-cfn-lambda-alias-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaFunctionAlias } from "../../function/version/sim-lambda-function-alias.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaAliasCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -24,6 +25,6 @@ export declare class SimCfnLambdaAliasCreator {
     /**
      * Create an alias from an AWS::Lambda::Alias Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaFunctionAlias>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLambdaFunctionAlias>;
 }
 export {};

package/dist/service/lambda/cfn/alias/sim-cfn-lambda-alias-creator.js

@@ -22,7 +22,7 @@ export class SimCfnLambdaAliasCreator {
     /**
      * Create an alias from an AWS::Lambda::Alias Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const functionName = simCfnLambdaTargetFunctionName(this.propertyParser.requiredString(resource, properties["FunctionName"], "FunctionName"));
         const name = this.propertyParser.requiredString(resource, properties["Name"], "Name");
         await this.lambda.createAlias({
@@ -32,7 +32,7 @@ export class SimCfnLambdaAliasCreator {
                 FunctionVersion: this.propertyParser.requiredString(resource, properties["FunctionVersion"], "FunctionVersion"),
                 Description: this.propertyParser.optionalString(resource, properties["Description"], "Description"),
             },
-        });
+        }, options);
         const alias = this.lambda.getSimFunctionAlias(functionName, name);
         assertDefined(alias, `Sim Lambda alias ${name} of ${functionName} after CloudFormation creation`);
         return alias;

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaEventInvokeConfig } from "../../function/event-invoke/sim-lambda-event-invoke-config.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaEventInvokeConfigCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -20,6 +21,6 @@ export declare class SimCfnLambdaEventInvokeConfigCreator {
     /**
      * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaEventInvokeConfig>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLambdaEventInvokeConfig>;
 }
 export {};

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js

@@ -17,12 +17,12 @@ export class SimCfnLambdaEventInvokeConfigCreator {
     /**
      * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const { functionName, qualifier, input } = new SimCfnLambdaEventInvokeConfigProperties({
             resource,
             properties,
         }).createInput();
-        await this.lambda.putFunctionEventInvokeConfig({ input });
+        await this.lambda.putFunctionEventInvokeConfig({ input }, options);
         const config = this.lambda.getSimEventInvokeConfig(functionName, qualifier);
         assertDefined(config, `Sim Lambda event invoke config ${resource.logicalId} after ` +
             "CloudFormation creation");

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Take an AWS::Lambda::EventInvokeConfig off the function it was written on,
  * so what is left of the function retries the default number of times and
@@ -9,4 +10,4 @@ import type { SimLambda } from "../../sim-lambda.js";
  * takes its configs with it, so a teardown that reached the function first
  * would otherwise fail here over work it had already done.
  */
-export declare function simCfnLambdaRemoveEventInvokeConfig(lambda: SimLambda, resource: SimCfnResource): Promise<void>;
+export declare function simCfnLambdaRemoveEventInvokeConfig(lambda: SimLambda, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.js

@@ -8,12 +8,10 @@ import { simCfnLambdaCreatedResource } from "../sim-cfn-lambda-created-resource.
  * takes its configs with it, so a teardown that reached the function first
  * would otherwise fail here over work it had already done.
  */
-export async function simCfnLambdaRemoveEventInvokeConfig(lambda, resource) {
+export async function simCfnLambdaRemoveEventInvokeConfig(lambda, resource, options) {
     const { functionName, qualifier } = simCfnLambdaCreatedResource(resource, "event invoke config");
     if (lambda.getSimEventInvokeConfig(functionName, qualifier) === undefined) {
         return;
     }
-    await lambda.deleteFunctionEventInvokeConfig({
-        input: { FunctionName: functionName, Qualifier: qualifier },
-    });
+    await lambda.deleteFunctionEventInvokeConfig({ input: { FunctionName: functionName, Qualifier: qualifier } }, options);
 }

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaEventSourceMapping } from "../../event-source/sim-lambda-event-source-mapping.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaEventSourceMappingCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -20,6 +21,6 @@ export declare class SimCfnLambdaEventSourceMappingCreator {
     /**
      * Create a mapping from an AWS::Lambda::EventSourceMapping Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaEventSourceMapping>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLambdaEventSourceMapping>;
 }
 export {};

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-creator.js

@@ -17,13 +17,13 @@ export class SimCfnLambdaEventSourceMappingCreator {
     /**
      * Create a mapping from an AWS::Lambda::EventSourceMapping Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const created = await this.lambda.createEventSourceMapping({
             input: new SimCfnLambdaEventSourceMappingProperties({
                 resource,
                 properties,
             }).createInput(),
-        });
+        }, options);
         const mapping = this.lambda.getSimEventSourceMapping(created.UUID);
         assertDefined(mapping, `Sim Lambda event source mapping ${resource.logicalId} after ` +
             "CloudFormation creation");

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-creator.d.ts

@@ -3,6 +3,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLambdaFunction } from "../../function/sim-lambda-function.js";
 import type { SimLambda } from "../../sim-lambda.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnLambdaFunctionCreatorProperties {
     readonly lambda: SimLambda;
 }
@@ -23,6 +24,6 @@ export declare class SimCfnLambdaFunctionCreator {
      * through their actual handler while still deploying it through
      * CloudFormation.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, bindings?: readonly SimCfnBinding[]): Promise<SimLambdaFunction>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, bindings?: readonly SimCfnBinding[], options?: SimCfnResourceCallerOptions): Promise<SimLambdaFunction>;
 }
 export {};