@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimSns } from "../../sim-sns.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
 interface SimCfnSnsTopicPolicyCreatorProperties {
     readonly sns: SimSns;
@@ -24,7 +25,14 @@ export declare class SimCfnSnsTopicPolicyCreator {
      * topic policy has no existence of its own in SNS: it is the `Policy`
      * attribute of the topics it names.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSnsTopic>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimSnsTopic>;
+    /**
+     * Take the policy back off every topic the Resource named.
+     *
+     * The Resource points at only the first of them, so the topics are read from
+     * the template the same way creation read them.
+     */
+    delete(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     /**
      * Set the policy on one topic and hand back the topic it was set on.
      */

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.js

@@ -26,28 +26,44 @@ export class SimCfnSnsTopicPolicyCreator {
      * topic policy has no existence of its own in SNS: it is the `Policy`
      * attribute of the topics it names.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const { logicalId } = resource;
         const topicArns = simCfnSnsPolicyTopicArns(logicalId, properties);
         const policy = jsonStringify(simCfnSnsPolicyDocument(logicalId, properties));
         return simCfnSnsResourceCreation(snsTopicPolicyResourceType, logicalId, async () => {
-            const topics = await Promise.all(topicArns.map(async (topicArn) => this.policyApplied(topicArn, policy)));
+            const topics = await Promise.all(topicArns.map(async (topicArn) => this.policyApplied(topicArn, policy, options)));
             const first = topics[0];
             assertDefined(first, `sim SNS topic after CloudFormation topic policy creation for ${logicalId}`);
             return first;
         });
     }
+    /**
+     * Take the policy back off every topic the Resource named.
+     *
+     * The Resource points at only the first of them, so the topics are read from
+     * the template the same way creation read them.
+     */
+    async delete(resource, properties, options) {
+        const topicArns = simCfnSnsPolicyTopicArns(resource.logicalId, properties);
+        await Promise.all(topicArns.map(async (topicArn) => this.sns.setTopicAttributes({
+            input: {
+                TopicArn: topicArn,
+                AttributeName: simSnsPolicyAttributeName,
+                AttributeValue: "",
+            },
+        }, options)));
+    }
     /**
      * Set the policy on one topic and hand back the topic it was set on.
      */
-    async policyApplied(topicArn, policy) {
+    async policyApplied(topicArn, policy, options) {
         await this.sns.setTopicAttributes({
             input: {
                 TopicArn: topicArn,
                 AttributeName: simSnsPolicyAttributeName,
                 AttributeValue: policy,
             },
-        });
+        }, options);
         const parts = parseSnsTopicArn(topicArn);
         assertDefined(parts, `topic ARN ${topicArn} SetTopicAttributes accepted`);
         const topic = this.sns.findTopic(parts.name);

package/dist/service/sns/delivery/lambda/sim-sns-delivery-function.js

@@ -3,6 +3,7 @@ import { SimSnsDeliveryNotPermitted } from "../../error/sim-sns-delivery.error.j
 import { SimSnsNotFoundException } from "../../error/sim-sns.error.js";
 import { simSnsDeliverySource, simSnsServicePrincipal, } from "../sim-sns-delivery.js";
 import { simSnsLambdaEventDocument } from "./sim-sns-lambda-event.js";
+import { simScopeIamAuthZ } from "../../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * One function a simulated topic is delivering to, in the Account and Region
  * its ARN names.
@@ -45,7 +46,7 @@ export class SimSnsDeliveryFunction {
                     "alias.");
         }
         const decision = new SimLambdaServiceInvokeAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             resource: target.resource,
             servicePrincipal: simSnsServicePrincipal,

package/dist/service/sns/delivery/sqs/sim-sns-delivery-queue.js

@@ -3,6 +3,7 @@ import { SimSnsDeliveryNotPermitted } from "../../error/sim-sns-delivery.error.j
 import { SimSnsNotFoundException } from "../../error/sim-sns.error.js";
 import { simSnsDeliverySource, simSnsServicePrincipal, } from "../sim-sns-delivery.js";
 import { SimSnsQueueMessage } from "./sim-sns-queue-message.js";
+import { simScopeIamAuthZ } from "../../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * One queue a simulated topic is delivering to, in the Account and Region its
  * ARN names.
@@ -38,7 +39,7 @@ export class SimSnsDeliveryQueue {
             throw new SimSnsNotFoundException(`${endpointArn} is not a simulated SQS queue.`);
         }
         const decision = new SimSqsServiceSendAuthorizer({
-            iam: this.scope.iam(),
+            iam: simScopeIamAuthZ(this.scope),
         }).authorize({
             queue,
             servicePrincipal: simSnsServicePrincipal,

package/dist/service/sns/sim-sns.d.ts

@@ -2,7 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import { SimAwsMessageLog } from "../aws/message/sim-aws-message-log.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimSnsDeliveryFailure } from "./delivery/sim-sns-delivery-failures.js";
 import type { SimSnsOutwardDeliveryEndpoints } from "./delivery/sim-sns-protocol-delivery-endpoints.js";
 import type * as simSnsCommands from "./command/sim-sns-command.types.js";

package/dist/service/sns/sim-sns.js

@@ -1,7 +1,7 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimAwsMessageLog } from "../aws/message/sim-aws-message-log.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { simSnsNoDeliveryEndpoints } from "./delivery/sim-sns-no-delivery-endpoints.js";
 import { SimSnsCommands } from "./command/sim-sns-commands.js";
 import { SimSnsCfnResourceFactory } from "./cfn/sim-sns-cfn-resource-factory.js";
@@ -24,7 +24,8 @@ export class SimSns extends SimSnsSms {
     sdkRouter;
     cfnFactory;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), deliveryEndpoints = simSnsNoDeliveryEndpoints(), messageLog = new SimAwsMessageLog(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), deliveryEndpoints = simSnsNoDeliveryEndpoints(), messageLog = new SimAwsMessageLog(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const topics = new SimSnsTopicStore();
         const subscriptions = new SimSnsSubscriptionStore();
         super({

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimSqs } from "../../sim-sqs.js";
 import type { SimSqsQueue } from "../../queue/sim-sqs-queue.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnSqsQueueCreatorProperties {
     readonly sqs: SimSqs;
 }
@@ -19,6 +20,6 @@ export declare class SimCfnSqsQueueCreator {
     /**
      * Create a queue from an AWS::SQS::Queue Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSqsQueue>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimSqsQueue>;
 }
 export {};

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-creator.js

@@ -16,15 +16,13 @@ export class SimCfnSqsQueueCreator {
     /**
      * Create a queue from an AWS::SQS::Queue Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const queueProperties = new SimCfnSqsQueueProperties({
             resource,
             properties,
         });
         const name = queueProperties.name();
-        await this.sqs.createQueue({
-            input: { QueueName: name, Attributes: queueProperties.attributes() },
-        });
+        await this.sqs.createQueue({ input: { QueueName: name, Attributes: queueProperties.attributes() } }, options);
         const queue = this.sqs.findQueue(name);
         assertDefined(queue, `sim SQS queue ${name} after CloudFormation creation`);
         return queue;

package/dist/service/sqs/cfn/queue-policy/sim-cfn-sqs-queue-policy-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimSqsQueue } from "../../queue/sim-sqs-queue.js";
 import type { SimSqs } from "../../sim-sqs.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnSqsQueuePolicyCreatorProperties {
     readonly sqs: SimSqs;
 }
@@ -24,7 +25,7 @@ export declare class SimCfnSqsQueuePolicyCreator {
      * queue policy has no existence of its own in SQS: it is the `Policy`
      * attribute of the queues it names.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSqsQueue>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimSqsQueue>;
     /**
      * Set the policy on one queue and hand back the queue it was set on.
      */

package/dist/service/sqs/cfn/queue-policy/sim-cfn-sqs-queue-policy-creator.js

@@ -23,10 +23,10 @@ export class SimCfnSqsQueuePolicyCreator {
      * queue policy has no existence of its own in SQS: it is the `Policy`
      * attribute of the queues it names.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const queueUrls = this.queueUrlsForResource(resource, properties);
         const policy = jsonStringify(this.policyDocumentForResource(resource, properties));
-        const queues = await Promise.all(queueUrls.map(async (queueUrl) => this.policyApplied(queueUrl, policy)));
+        const queues = await Promise.all(queueUrls.map(async (queueUrl) => this.policyApplied(queueUrl, policy, options)));
         const first = queues[0];
         assertDefined(first, `sim SQS queue after CloudFormation queue policy creation for ${resource.logicalId}`);
         return first;
@@ -34,13 +34,13 @@ export class SimCfnSqsQueuePolicyCreator {
     /**
      * Set the policy on one queue and hand back the queue it was set on.
      */
-    async policyApplied(queueUrl, policy) {
+    async policyApplied(queueUrl, policy, options) {
         await this.sqs.setQueueAttributes({
             input: {
                 QueueUrl: queueUrl,
                 Attributes: { [simSqsQueuePolicyAttributeName]: policy },
             },
-        });
+        }, options);
         const parts = SimSqsQueueUrl.parse(queueUrl);
         assertDefined(parts, `queue URL ${queueUrl} SetQueueAttributes accepted`);
         const queue = this.sqs.findQueue(parts.name);

package/dist/service/sqs/cfn/sim-cfn-sqs-resource-deleter.d.ts

@@ -1,6 +1,7 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimSqs } from "../sim-sqs.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnSqsResourceDeleterProperties {
     readonly sqs: SimSqs;
 }
@@ -18,7 +19,7 @@ export declare class SimCfnSqsResourceDeleter {
     /**
      * Delete a simulated SQS resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<void>;
     private deleteQueue;
     /**
      * Take the policy back off every queue the Resource named.

package/dist/service/sqs/cfn/sim-cfn-sqs-resource-deleter.js

@@ -16,14 +16,14 @@ export class SimCfnSqsResourceDeleter {
     /**
      * Delete a simulated SQS resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource, properties) {
+    async delete(resourceTypeName, resource, properties, options) {
         switch (resourceTypeName) {
             case "Queue": {
-                await this.deleteQueue(resource);
+                await this.deleteQueue(resource, options);
                 return;
             }
             case "QueuePolicy": {
-                await this.clearQueuePolicy(properties);
+                await this.clearQueuePolicy(properties, options);
                 return;
             }
             default: {
@@ -31,10 +31,10 @@ export class SimCfnSqsResourceDeleter {
             }
         }
     }
-    async deleteQueue(resource) {
+    async deleteQueue(resource, options) {
         const queue = resource.simResource;
         assertDefined(queue, `sim SQS queue for CloudFormation Resource ${resource.logicalId}`);
-        await this.sqs.deleteQueue({ input: { QueueUrl: queue.url } });
+        await this.sqs.deleteQueue({ input: { QueueUrl: queue.url } }, options);
     }
     /**
      * Take the policy back off every queue the Resource named.
@@ -42,7 +42,7 @@ export class SimCfnSqsResourceDeleter {
      * The Resource points at only the first of them, so the queues are read from
      * the template the same way creation read them.
      */
-    async clearQueuePolicy(properties) {
+    async clearQueuePolicy(properties, options) {
         const queues = properties["Queues"];
         /* v8 ignore if -- creation refused the Resource without a Queues list */
         if (!Array.isArray(queues)) {
@@ -55,6 +55,6 @@ export class SimCfnSqsResourceDeleter {
                 QueueUrl: queueUrl,
                 Attributes: { [simSqsQueuePolicyAttributeName]: "" },
             },
-        })));
+        }, options)));
     }
 }

package/dist/service/sqs/cfn/sim-sqs-cfn-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnSqsQueueCreator } from "./queue/sim-cfn-sqs-queue-creator.js";
 import { SimCfnSqsQueuePolicyCreator } from "./queue-policy/sim-cfn-sqs-queue-policy-creator.js";
 import { SimCfnSqsResourceDeleter } from "./sim-cfn-sqs-resource-deleter.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated SQS resources.
  */
@@ -23,12 +24,13 @@ export class SimSqsCfnResourceFactory {
      * quietly treated as deployed.
      */
     async create(resourceTypeName, resource, context) {
+        const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "Queue": {
-                return await this.queueCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.queueCreator.create(resource, context.resolvedProperties ?? resource.properties, options);
             }
             case "QueuePolicy": {
-                return await this.queuePolicyCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.queuePolicyCreator.create(resource, context.resolvedProperties ?? resource.properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim SQS CloudFormation Resource ${resourceTypeName}`);
@@ -39,6 +41,6 @@ export class SimSqsCfnResourceFactory {
      * Delete a simulated SQS resource created from a CloudFormation Resource.
      */
     async delete(resourceTypeName, resource, context) {
-        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties);
+        await this.deleter.delete(resourceTypeName, resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/sqs/sim-sqs.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simSqsCommands from "./command/sim-sqs-command.types.js";
 import type { SimSqsRequestOptions } from "./command/sim-sqs-request-options.js";
 import { SimSqsCfnResourceFactory } from "./cfn/sim-sqs-cfn-resource-factory.js";

package/dist/service/sqs/sim-sqs.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimSqsAuthorizer } from "./command/authorize/sim-sqs-authorizer.js";
 import { SimSqsChangeMessageVisibility } from "./command/message/sim-sqs-change-message-visibility.js";
 import { SimSqsDeleteMessageCommands } from "./command/message/sim-sqs-delete-message-commands.js";
@@ -39,7 +39,8 @@ export class SimSqs {
     sdkRouter = new SimSqsSdkCommandRouter(this);
     cfnFactory = new SimSqsCfnResourceFactory({ sqs: this });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const access = new SimSqsQueueAccess({
             queues: this.queues,
             authorizer: new SimSqsAuthorizer({ iam }),

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.d.ts

@@ -1,16 +1,26 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -18,14 +28,20 @@ interface SimCfnSsmDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the parameter value it names.
      */
-    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution;
+    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution | Promise<SimCfnDynamicReferenceResolution>;
     /**
      * Read the version the reference selects, or the current one.
      */
     private parameterValue;
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    private readValue;
 }
 export {};

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.js

@@ -1,14 +1,25 @@
-import { SimSsmParameterVersionNotFound } from "../../error/sim-ssm.error.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
+/** The parameter type a plain `ssm` reference leaves to `ssm-secure`. */
+const secureString = "SecureString";
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -16,8 +27,10 @@ import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
  */
 export class SimCfnSsmDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the parameter value it names.
@@ -28,33 +41,35 @@ export class SimCfnSsmDynamicReferenceResolver {
             return simCfnSsmReferenceStandIn(reference, reference.body, `which is not the parameter name, optionally followed by an integer ` +
                 `version, that an ssm dynamic reference takes`);
         }
-        const { name, version } = parsed;
-        const parameter = this.ssm.findParameter(name);
-        if (parameter === undefined) {
-            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store holds no parameter '${name}'`);
-        }
-        if (parameter.type.value === "SecureString") {
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
-                `through an ssm-secure reference`);
-        }
-        return this.parameterValue(reference, parameter, name, version);
+        return this.parameterValue(reference, parsed.name, parsed.version);
     }
     /**
      * Read the version the reference selects, or the current one.
      */
-    parameterValue(reference, parameter, name, version) {
-        if (version === undefined) {
-            return { value: parameter.currentVersion.value.value };
-        }
+    async parameterValue(reference, name, version) {
+        const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            return { value: parameter.versionNumbered(Number(version)).value.value };
+            const read = await this.ssm.getParameter({ input: { Name: selector } }, this.callerOptions);
+            assertDefined(read.Parameter, `the parameter read for '${name}'`);
+            return this.readValue(reference, name, read.Parameter);
         }
         catch (error) {
-            /* v8 ignore next 3 -- defensive: only a missing version reaches here */
-            if (!(error instanceof SimSsmParameterVersionNotFound)) {
+            if (!(error instanceof SimSsmError)) {
                 throw error;
             }
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' has no version ${version}`);
+            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store could not read it (${error.message})`);
+        }
+    }
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    readValue(reference, name, parameter) {
+        if (parameter.Type === secureString) {
+            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
+                `through an ssm-secure reference`);
         }
+        assertDefined(parameter.Value, `the value read for '${name}'`);
+        return { value: parameter.Value };
     }
 }

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.d.ts

@@ -1,18 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver, SimCfnDynamicReferenceSite } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmSecureDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm-secure:...}}` references from the simulated Parameter
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,6 +26,7 @@ interface SimCfnSsmSecureDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmSecureDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmSecureDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the decrypted parameter value it names.

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.js

@@ -1,4 +1,5 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
@@ -8,11 +9,12 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,8 +24,10 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  */
 export class SimCfnSsmSecureDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the decrypted parameter value it names.
@@ -47,9 +51,7 @@ export class SimCfnSsmSecureDynamicReferenceResolver {
     async decrypted(reference, name, version) {
         const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            const read = await this.ssm.getParameter({
-                input: { Name: selector, WithDecryption: true },
-            });
+            const read = await this.ssm.getParameter({ input: { Name: selector, WithDecryption: true } }, this.callerOptions);
             const parameter = read.Parameter;
             assertDefined(parameter, `the parameter read for '${name}'`);
             requireSecureStringParameter(name, parameter);

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-re
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimSsmParameter } from "../../parameter/sim-ssm-parameter.js";
 import type { SimSsm } from "../../sim-ssm.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnSsmParameterCreatorProperties {
     readonly ssm: SimSsm;
 }
@@ -25,6 +26,6 @@ export declare class SimCfnSsmParameterCreator {
     /**
      * Create a parameter from an AWS::SSM::Parameter Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSsmParameter>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimSsmParameter>;
 }
 export {};

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.js

@@ -22,7 +22,7 @@ export class SimCfnSsmParameterCreator {
     /**
      * Create a parameter from an AWS::SSM::Parameter Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const parameterProperties = new SimCfnSsmParameterProperties({
             resource,
             properties,
@@ -40,7 +40,7 @@ export class SimCfnSsmParameterCreator {
                 Policies: parameterProperties.policies(),
                 Tags: parameterProperties.tags(),
             },
-        });
+        }, options);
         const parameter = this.ssm.findParameter(name);
         assertDefined(parameter, `sim SSM parameter ${name} after CloudFormation creation`);
         return parameter;