@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/ssm/cfn/sim-cfn-ssm-resource-factory.d.ts

@@ -1,5 +1,5 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimSsm } from "../sim-ssm.js";
 interface SimSsmCfnResourceFactoryProperties {
     readonly ssm: SimSsm;
@@ -22,6 +22,6 @@ export declare class SimSsmCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated SSM resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/ssm/cfn/sim-cfn-ssm-resource-factory.js

@@ -1,3 +1,4 @@
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnSsmParameterCreator } from "./parameter/sim-cfn-ssm-parameter-creator.js";
 import { assertDefined } from "../../../util/type-guard/defined.js";
 /**
@@ -22,7 +23,7 @@ export class SimSsmCfnResourceFactory {
     async create(resourceTypeName, resource, context) {
         switch (resourceTypeName) {
             case "Parameter": {
-                return await this.parameterCreator.create(resource, context.resolvedProperties ?? resource.properties);
+                return await this.parameterCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
             }
             default: {
                 throw new Error(`Unsupported sim SSM CloudFormation Resource ${resourceTypeName}`);
@@ -32,12 +33,12 @@ export class SimSsmCfnResourceFactory {
     /**
      * Delete a simulated SSM resource created from a CloudFormation Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Parameter") {
             throw new Error(`Unsupported sim SSM CloudFormation Resource ${resourceTypeName} deletion`);
         }
         const parameter = resource.simResource;
         assertDefined(parameter, `sim SSM Parameter for CloudFormation Resource ${resource.logicalId}`);
-        await this.ssm.deleteParameter({ input: { Name: parameter.name.value } });
+        await this.ssm.deleteParameter({ input: { Name: parameter.name.value } }, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/ssm/sim-ssm.d.ts

@@ -2,7 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simSsmCommands from "./command/sim-ssm-command.types.js";
 import { SimSsmCfnResourceFactory } from "./cfn/sim-cfn-ssm-resource-factory.js";
 import { SimCfnSsmDynamicReferenceResolver } from "./cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.js";
@@ -86,12 +86,20 @@ export declare class SimSsm {
     cfnResourceFactory(): SimSsmCfnResourceFactory;
     /**
      * Get the resolver for `{{resolve:ssm:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnDynamicReferenceResolver(): SimCfnSsmDynamicReferenceResolver;
+    cfnDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmDynamicReferenceResolver;
     /**
      * Get the resolver for `{{resolve:ssm-secure:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnSecureDynamicReferenceResolver(): SimCfnSsmSecureDynamicReferenceResolver;
+    cfnSecureDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmSecureDynamicReferenceResolver;
     /**
      * Get the reader for `AWS::SSM::Parameter::Value<...>` template Parameters.
      */

package/dist/service/ssm/sim-ssm.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimKms } from "../kms/index.js";
 import { SimSsmAuthorizer } from "./command/authorize/sim-ssm-authorizer.js";
 import { SimSsmDeleteParameterCommands } from "./command/parameter/sim-ssm-delete-parameter-commands.js";
@@ -37,7 +37,8 @@ export class SimSsm {
     sdkRouter = new SimSsmSdkCommandRouter(this);
     cfnFactory = new SimSsmCfnResourceFactory({ ssm: this });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const { kms = new SimKms({ accountRegionScope, iam, background }) } = properties;
         const authorizer = new SimSsmAuthorizer({ iam, accountRegionScope });
         const encryption = new SimSsmParameterEncryption({ kms });
@@ -139,15 +140,23 @@ export class SimSsm {
     }
     /**
      * Get the resolver for `{{resolve:ssm:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnDynamicReferenceResolver() {
-        return new SimCfnSsmDynamicReferenceResolver({ ssm: this });
+    cfnDynamicReferenceResolver(caller) {
+        return new SimCfnSsmDynamicReferenceResolver({ ssm: this, caller });
     }
     /**
      * Get the resolver for `{{resolve:ssm-secure:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnSecureDynamicReferenceResolver() {
-        return new SimCfnSsmSecureDynamicReferenceResolver({ ssm: this });
+    cfnSecureDynamicReferenceResolver(caller) {
+        return new SimCfnSsmSecureDynamicReferenceResolver({ ssm: this, caller });
     }
     /**
      * Get the reader for `AWS::SSM::Parameter::Value<...>` template Parameters.

package/dist/service/stepfunctions/cfn/sim-cfn-step-functions-resource-deleter.d.ts

@@ -1,5 +1,6 @@
 import type { SimStepFunctions } from "../sim-step-functions.js";
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnStepFunctionsResourceDeleterProperties {
     readonly stepFunctions: SimStepFunctions;
 }
@@ -14,6 +15,6 @@ export declare class SimCfnStepFunctionsResourceDeleter {
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/stepfunctions/cfn/sim-cfn-step-functions-resource-deleter.js

@@ -13,15 +13,13 @@ export class SimCfnStepFunctionsResourceDeleter {
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource) {
+    async delete(resourceTypeName, resource, options) {
         if (resourceTypeName !== stateMachineResourceTypeName) {
             throw new Error(`Unsupported sim StepFunctions CloudFormation Resource ` +
                 `${resourceTypeName} deletion`);
         }
         const stateMachine = resource.simResource;
         assertDefined(stateMachine, `sim state machine for CloudFormation Resource ${resource.logicalId}`);
-        await this.#stepFunctions.deleteStateMachine({
-            input: { stateMachineArn: stateMachine.arn },
-        });
+        await this.#stepFunctions.deleteStateMachine({ input: { stateMachineArn: stateMachine.arn } }, options);
     }
 }

package/dist/service/stepfunctions/cfn/sim-step-functions-cfn-resource-factory.d.ts

@@ -28,6 +28,6 @@ export declare class SimStepFunctionsCfnResourceFactory implements SimCfnService
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource, _context: SimCloudFormationResourceDeleteContext): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/stepfunctions/cfn/sim-step-functions-cfn-resource-factory.js

@@ -1,6 +1,7 @@
 import { SimCfnStateMachineCreator } from "./state-machine/sim-cfn-state-machine-creator.js";
 import { SimCfnStepFunctionsResourceDeleter } from "./sim-cfn-step-functions-resource-deleter.js";
 import { stateMachineResourceTypeName } from "./sim-cfn-step-functions-resource-types.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for simulated Step Functions resources.
  */
@@ -30,13 +31,13 @@ export class SimStepFunctionsCfnResourceFactory {
         if (resourceTypeName !== stateMachineResourceTypeName) {
             throw new Error(`Unsupported sim StepFunctions CloudFormation Resource ${resourceTypeName}`);
         }
-        return await this.#stateMachineCreator.create(resource, context.resolvedProperties ?? resource.properties);
+        return await this.#stateMachineCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller));
     }
     /**
      * Delete a simulated Step Functions resource created from a CloudFormation
      * Resource.
      */
-    async delete(resourceTypeName, resource, _context) {
-        await this.#deleter.delete(resourceTypeName, resource);
+    async delete(resourceTypeName, resource, context) {
+        await this.#deleter.delete(resourceTypeName, resource, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/stepfunctions/cfn/state-machine/sim-cfn-state-machine-creator.d.ts

@@ -3,6 +3,7 @@ import type { SimStatesDefinitionStore } from "../../definition/store/sim-states
 import type { SimStepFunctions } from "../../sim-step-functions.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnStateMachineCreatorProperties {
     readonly stepFunctions: SimStepFunctions;
     /** Where a `DefinitionS3Location` is read from. */
@@ -24,6 +25,6 @@ export declare class SimCfnStateMachineCreator {
     /**
      * Create a state machine from an AWS::StepFunctions::StateMachine Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimStateMachine>;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimStateMachine>;
 }
 export {};

package/dist/service/stepfunctions/cfn/state-machine/sim-cfn-state-machine-creator.js

@@ -22,7 +22,7 @@ export class SimCfnStateMachineCreator {
     /**
      * Create a state machine from an AWS::StepFunctions::StateMachine Resource.
      */
-    async create(resource, properties) {
+    async create(resource, properties, options) {
         const stateMachineProperties = new SimCfnStateMachineProperties({
             resource,
             properties,
@@ -42,7 +42,7 @@ export class SimCfnStateMachineCreator {
                     tags,
                     ...(type !== undefined && { type }),
                 },
-            });
+            }, options);
             const stateMachine = this.#stepFunctions.findStateMachine(name);
             assertDefined(stateMachine, `sim state machine ${name} after CloudFormation creation`);
             return stateMachine;

package/dist/service/stepfunctions/task/sim-aws-states-task-targets.js

@@ -29,10 +29,8 @@ export class SimAwsStatesTaskTargets {
     async invoke(invocation) {
         const { stateName, target } = invocation;
         const role = simStatesExecutionRoleTarget(invocation.roleArn, stateName);
-        const iam = this.#simAws
-            .accountRegionScope(role.accountId, this.#accountRegionScope.regionName)
-            .iam();
-        const caller = await assumeSimStatesExecutionRole(role, iam);
+        const roleScope = this.#simAws.accountRegionScope(role.accountId, this.#accountRegionScope.regionName);
+        const caller = await assumeSimStatesExecutionRole(role, roleScope);
         return await target.run({
             stateName,
             payload: invocation.payload,

package/dist/service/stepfunctions/task/sim-states-execution-role.d.ts

@@ -1,6 +1,6 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
-import type { SimIam } from "../../iam/sim-iam.js";
-import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role.js";
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
 /**
  * The service principal a state machine's execution role trusts.
  */
@@ -21,4 +21,4 @@ export declare function simStatesExecutionRoleTarget(roleArn: string, stateName:
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, iam: SimIam): Promise<SimAwsCaller>;
+export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer): Promise<SimAwsCaller>;

package/dist/service/stepfunctions/task/sim-states-execution-role.js

@@ -1,4 +1,5 @@
-import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { assumeSimServiceRole, } from "../../sts/service-role/sim-service-role.js";
+import { simServiceRoleTarget, } from "../../sts/service-role/sim-service-role-target.js";
 import { SimStatesTaskFailure } from "../error/sim-step-functions.error.js";
 /**
  * The service principal a state machine's execution role trusts.
@@ -45,12 +46,12 @@ const refusals = {
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export async function assumeSimStatesExecutionRole(target, iam) {
+export async function assumeSimStatesExecutionRole(target, scope) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simStatesServicePrincipal,
         sessionName,
-        iam,
+        scope,
         refusals,
     });
 }

package/dist/service/stepfunctions/task/sim-states-task-function.js

@@ -1,4 +1,5 @@
 import { SimStatesTaskFailure } from "../error/sim-step-functions.error.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * The action an execution needs to invoke a function.
  */
@@ -40,7 +41,7 @@ export class SimStatesTaskFunction {
      * only its own identity policy.
      */
     authorize(request, functionArn) {
-        const decision = this.#scope.iam().authorize({
+        const decision = simScopeIamAuthZ(this.#scope).authorize({
             action: invokeAction,
             resource: functionArn,
             caller: request.caller,

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,5 +1,6 @@
 import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
@@ -7,6 +8,8 @@ import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser
 interface AssumeRoleAuthorizationCoordinatorProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /** The Region the STS request was made in. */
+    readonly regionName: AwsRegionName;
 }
 interface AssumeRoleAuthorizationInput {
     readonly roleArn: string;

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -20,13 +20,8 @@ export class AssumeRoleAuthorizationCoordinator {
     targetRoleAuthorizer;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
-        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer({
-            sourceAccountId: properties.sourceAccountId,
-            iamResolver: properties.iamResolver,
-        });
-        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer({
-            iamResolver: properties.iamResolver,
-        });
+        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer(properties);
+        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer(properties);
     }
     /**
      * Require the applicable source identity and target trust permissions.

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.d.ts

@@ -1,9 +1,14 @@
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleSourceAccountAuthorizerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The Region the STS request was made in.
+     */
+    readonly regionName: AwsRegionName;
 }
 export interface AssumeRoleSourceAuthorizationInput {
     readonly roleArn: string;
@@ -32,6 +37,7 @@ export interface AssumeRoleSourceAuthorizationInput {
 export declare class AssumeRoleSourcePrincipalAuthorizer {
     private readonly sourceAccountId;
     private readonly iamResolver;
+    private readonly regionName;
     constructor(properties: AssumeRoleSourceAccountAuthorizerProperties);
     /**
      * Require the source Account to allow the caller to assume the target role.

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.js

@@ -16,9 +16,11 @@ import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 export class AssumeRoleSourcePrincipalAuthorizer {
     sourceAccountId;
     iamResolver;
+    regionName;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
         this.iamResolver = properties.iamResolver;
+        this.regionName = properties.regionName;
     }
     /**
      * Require the source Account to allow the caller to assume the target role.
@@ -33,6 +35,7 @@ export class AssumeRoleSourcePrincipalAuthorizer {
         const decision = sourceIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
+            region: this.regionName,
             caller: callerPrincipal,
         });
         if (decision.isExplicitDeny ||

package/dist/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -1,5 +1,6 @@
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
@@ -7,6 +8,10 @@ import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import { type AssumeRoleTrustPolicyAuthorization } from "./assume-role-trust-policy-authorizer.js";
 interface AssumeRoleTargetRoleAuthorizerProperties {
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The Region the STS request was made in.
+     */
+    readonly regionName: AwsRegionName;
 }
 type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
 interface AssumeRoleTargetAuthorizationInput {
@@ -31,6 +36,7 @@ interface AssumeRoleTargetAuthorization {
  */
 export declare class AssumeRoleTargetRoleAuthorizer {
     private readonly iamResolver;
+    private readonly regionName;
     private readonly targetResolver;
     private readonly trustPolicyAuthorizer;
     constructor(properties: AssumeRoleTargetRoleAuthorizerProperties);

package/dist/service/sts/auth-z/assume-role-target-auth-z.js

@@ -12,10 +12,12 @@ import { AssumeRoleTrustPolicyAuthorizer, } from "./assume-role-trust-policy-aut
  */
 export class AssumeRoleTargetRoleAuthorizer {
     iamResolver;
+    regionName;
     targetResolver = new AssumeRoleTargetResolver();
     trustPolicyAuthorizer = new AssumeRoleTrustPolicyAuthorizer();
     constructor(properties) {
         this.iamResolver = properties.iamResolver;
+        this.regionName = properties.regionName;
     }
     /**
      * Resolve the requested Role, load it from the target account, and require its
@@ -38,6 +40,7 @@ export class AssumeRoleTargetRoleAuthorizer {
             roleArn: input.roleArn,
             role,
             targetIam,
+            region: this.regionName,
             caller: input.caller,
             conditionContext: input.conditionContext,
         });

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -1,4 +1,5 @@
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
 import type { SimIam } from "../../iam/sim-iam.js";
@@ -8,6 +9,11 @@ interface AssumeRoleTrustPolicyAuthorizationInput {
     readonly roleArn: string;
     readonly role: AssumeRoleTargetRole;
     readonly targetIam: SimIam;
+    /**
+     * The Region the assume request was made in, which the trust policy and the
+     * target Account's service control policies can be conditioned on.
+     */
+    readonly region?: AwsRegionName | undefined;
     readonly caller: SimAwsPrincipal;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -37,6 +37,7 @@ export class AssumeRoleTrustPolicyAuthorizer {
         const decision = input.targetIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
+            region: input.region,
             caller: input.caller,
             conditionContext: input.conditionContext,
             resourcePolicies: [

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -3,9 +3,14 @@ import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-accoun
 import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-role.command.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
+    /**
+     * The Region this STS is in, which is the Region its requests are made in.
+     */
+    readonly regionName: AwsRegionName;
     readonly iamResolver: SimIamAccountResolver;
     readonly background?: BackgroundScheduler;
 }

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -22,12 +22,13 @@ export class AssumeRoleCommandHandler {
     sessionCreator;
     sourceAccountId;
     constructor(properties) {
-        const { sourceAccountId, iamResolver, background = new BackgroundTasks(), } = properties;
+        const { sourceAccountId, regionName, iamResolver, background = new BackgroundTasks(), } = properties;
         this.sourceAccountId = sourceAccountId;
         this.background = background;
         this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
             sourceAccountId,
             iamResolver,
+            regionName,
         });
         this.sessionCreator = new SimStsAssumeRoleSessionCreator({
             iamResolver,

package/dist/service/sts/service-role/sim-service-role-source.d.ts

@@ -0,0 +1,33 @@
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * The resource a service says it is assuming a role for, as `aws:SourceArn`.
+ */
+export declare const simServiceRoleSourceArnConditionKey = "aws:SourceArn";
+/**
+ * The Account owning that resource, as `aws:SourceAccount`.
+ */
+export declare const simServiceRoleSourceAccountConditionKey = "aws:SourceAccount";
+/**
+ * Which of its own resources a service is assuming a role on behalf of.
+ *
+ * AWS recommends conditioning a service role's trust policy on these two
+ * against the confused deputy problem, so that a role trusting
+ * `scheduler.amazonaws.com` is assumable for one schedule group rather than by
+ * Scheduler at large. Which resource counts is the service's own answer, and
+ * differs between services: Scheduler names a schedule group and EventBridge
+ * names a rule.
+ */
+export interface SimServiceRoleSource {
+    readonly arn: string;
+    readonly accountId: string;
+}
+/**
+ * The request-time values a trust policy statement's conditions are matched
+ * against.
+ *
+ * A service that states no source supplies neither key, so a trust policy
+ * conditioned on either fails to match instead of matching an empty string.
+ * That is the safe direction. A role scoped to one schedule group should refuse
+ * an assume request that says nothing about which group it is for.
+ */
+export declare function simServiceRoleConditionContext(source: SimServiceRoleSource | undefined): Readonly<Record<string, SimIamConditionValue>>;

package/dist/service/sts/service-role/sim-service-role-source.js

@@ -0,0 +1,26 @@
+/**
+ * The resource a service says it is assuming a role for, as `aws:SourceArn`.
+ */
+export const simServiceRoleSourceArnConditionKey = "aws:SourceArn";
+/**
+ * The Account owning that resource, as `aws:SourceAccount`.
+ */
+export const simServiceRoleSourceAccountConditionKey = "aws:SourceAccount";
+/**
+ * The request-time values a trust policy statement's conditions are matched
+ * against.
+ *
+ * A service that states no source supplies neither key, so a trust policy
+ * conditioned on either fails to match instead of matching an empty string.
+ * That is the safe direction. A role scoped to one schedule group should refuse
+ * an assume request that says nothing about which group it is for.
+ */
+export function simServiceRoleConditionContext(source) {
+    if (source === undefined) {
+        return {};
+    }
+    return {
+        [simServiceRoleSourceArnConditionKey]: source.arn,
+        [simServiceRoleSourceAccountConditionKey]: source.accountId,
+    };
+}

package/dist/service/sts/service-role/sim-service-role-target.d.ts

@@ -0,0 +1,26 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Which IAM a role ARN belongs to, and what the role is called there.
+ */
+export interface SimServiceRoleTarget {
+    readonly accountId: SimAwsAccountId;
+    readonly roleName: string;
+    readonly roleArn: string;
+}
+/**
+ * Read the Account and name out of a role ARN a service will assume.
+ *
+ * The ARN is checked for being a role ARN where the request that carried it was
+ * written, so this is reading a known shape rather than validating an unknown
+ * one.
+ */
+export declare function simServiceRoleTarget(roleArn: string): SimServiceRoleTarget;
+/**
+ * The caller one assumed service-role session makes.
+ *
+ * It carries both principals. The request is attributed to the session, as it
+ * is on AWS, while the policies that apply are the role's. That is exactly the
+ * split `SimResolvedCaller` exists for.
+ */
+export declare function simServiceRoleCaller(target: SimServiceRoleTarget, sessionName: string): SimAwsCaller;

package/dist/service/sts/service-role/sim-service-role-target.js

@@ -0,0 +1,27 @@
+import { IamRoleArnParser } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+/**
+ * Read the Account and name out of a role ARN a service will assume.
+ *
+ * The ARN is checked for being a role ARN where the request that carried it was
+ * written, so this is reading a known shape rather than validating an unknown
+ * one.
+ */
+export function simServiceRoleTarget(roleArn) {
+    const parts = new IamRoleArnParser().parse(roleArn);
+    return { accountId: parts.accountId, roleName: parts.roleName, roleArn };
+}
+/**
+ * The caller one assumed service-role session makes.
+ *
+ * It carries both principals. The request is attributed to the session, as it
+ * is on AWS, while the policies that apply are the role's. That is exactly the
+ * split `SimResolvedCaller` exists for.
+ */
+export function simServiceRoleCaller(target, sessionName) {
+    const session = `arn:aws:sts::${target.accountId}:assumed-role/${target.roleName}/${sessionName}`;
+    return {
+        kind: "resolved",
+        principal: { kind: "arn", arn: session },
+        identityPolicyPrincipal: { kind: "arn", arn: target.roleArn },
+    };
+}