@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { SimCfnStack, type SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
 import type { SimCreateStackCommand, SimCreateStackCommandOutput } from "./create-stack.command.js";
@@ -14,6 +15,8 @@ interface CreateStackCommandHandlerProperties {
     readonly background: BackgroundScheduler & BackgroundCompleter;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /** The principal the Stack's Resources are created as. */
+    readonly caller?: SimAwsCaller | undefined;
     readonly exports?: SimCfnExports | undefined;
 }
 /**
@@ -28,6 +31,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly background;
     private readonly cdkOutContext;
     private readonly bindings;
+    private readonly caller;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -16,15 +16,17 @@ export class CreateStackCommandHandler {
     background;
     cdkOutContext;
     bindings;
+    caller;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
         this.background = background;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
         this.exports = exports;
     }
     /**
@@ -60,6 +62,7 @@ export class CreateStackCommandHandler {
             template,
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
+            caller: this.caller,
             exports: this.exports,
         });
         this.stacks.set(stack.stackName, stack);

package/dist/service/cloudformation/command/update-stack/update-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnStack, SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
@@ -16,6 +17,11 @@ interface UpdateStackCommandHandlerProperties {
      * applied from a template file rather than from an SDK Command.
      */
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal to apply the changed template as, for an update that names
+     * one. Left out, the Stack goes on running as whoever deployed it.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /** The export names published in this Account and Region. */
     readonly exports?: SimCfnExports | undefined;
 }
@@ -30,6 +36,7 @@ export declare class UpdateStackCommandHandler implements CommandHandler<SimUpda
     private readonly stacks;
     private readonly background;
     private readonly cdkOutContext;
+    private readonly caller;
     private readonly exports;
     constructor(properties: UpdateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/update-stack/update-stack.handler.js

@@ -14,6 +14,7 @@ export class UpdateStackCommandHandler {
     stacks;
     background;
     cdkOutContext;
+    caller;
     exports;
     constructor(properties) {
         this.simAws = properties.simAws;
@@ -21,6 +22,7 @@ export class UpdateStackCommandHandler {
         this.stacks = properties.stacks;
         this.background = properties.background;
         this.cdkOutContext = properties.cdkOutContext;
+        this.caller = properties.caller;
         this.exports = properties.exports;
     }
     /**
@@ -56,7 +58,7 @@ export class UpdateStackCommandHandler {
             parameters,
             accountRegionScope: this.accountRegionScope,
             exports: this.exports,
-        }), { cdkOutContext: this.cdkOutContext });
+        }), { cdkOutContext: this.cdkOutContext, caller: this.caller });
         return {
             StackId: stack.stackName,
             $metadata: {},

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -35,6 +35,7 @@ export class SimCfnCdkOutDeployer {
             templatePath: stack.templatePath,
             stackName: stack.stackName,
             ...options,
+            caller: caller ?? plan.caller,
             transform: cdkOutBoundTransform(transform, deployed),
         });
     }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -1,4 +1,5 @@
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
 export interface SimCloudFormationDeployCdkOutProperties {
@@ -17,8 +18,13 @@ export interface SimCloudFormationDeployCdkOutProperties {
      */
     readonly stackNames?: readonly string[] | undefined;
     /**
-     * Bindings, parameters and a transform for individual Stacks, keyed the same
-     * way `stackNames` names them.
+     * The principal every Stack in the assembly is deployed as, which one named
+     * in `stackOptions` overrides for its own Stack.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Bindings, parameters, a caller and a transform for individual Stacks,
+     * keyed the same way `stackNames` names them.
      */
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
@@ -28,6 +34,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 }
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
+    readonly caller?: SimAwsCaller | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, stackOptions } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -22,6 +22,7 @@ export async function planCdkOutDeployment(properties) {
             ...stack,
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
+        caller,
         stackOptions,
     };
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -1,5 +1,6 @@
 import type { SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDeployedStack } from "../stack/sim-cfn-deployed-stack.type.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import type { SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
@@ -26,6 +27,12 @@ export type SimCfnCdkOutTemplateTransform = (template: CfnTemplateBodyRecord, de
 export interface SimCfnCdkOutStackOptions {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal this Stack is deployed as, where the assembly's own caller
+     * is not the right one for it. A pipeline Stack deployed by one role and an
+     * application Stack deployed by another is what this is for.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     readonly transform?: SimCfnCdkOutTemplateTransform | undefined;
 }
 export type SimCfnCdkOutStackOptionsByName = Record<string, SimCfnCdkOutStackOptions>;
@@ -43,8 +50,8 @@ export declare function cdkOutBoundTransform(transform: SimCfnCdkOutTemplateTran
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.js

@@ -20,17 +20,14 @@ export function cdkOutBoundTransform(transform, deployed) {
 /**
  * Refuse options keyed against a Stack that is not being deployed.
  *
- * A renamed Stack would otherwise take its bindings and its transform with it
- * without saying anything, and the deployment that lost them looks like one
- * that never had them.
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
  */
 export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
     const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
     const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
     if (unmatched.length > 0) {
-        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${stackNames(deploying)}.`);
+        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
     }
 }
-function stackNames(stacks) {
-    return stacks.map((stack) => stack.stackName).join(", ");
-}

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -5,6 +5,7 @@ import { type SimCloudFormationDeployTemplateFileProperties as SimCloudFormation
 import { type SimCloudFormationDeployCdkOutProperties } from "./sim-cfn-cdk-out-deployer.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
@@ -13,6 +14,15 @@ export interface SimCloudFormationCreateStackProperties {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * The synthesized CDK template file this in-memory template stands in for.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -58,6 +58,7 @@ export class SimCloudFormationTemplateDeployer {
             template: properties.template,
             parameters: properties.parameters,
             bindings: properties.bindings,
+            caller: properties.caller,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
     }
@@ -110,13 +111,13 @@ export class SimCloudFormationTemplateDeployer {
                     ParameterValue: parameterValue,
                 })),
             },
-        }, properties.cdkOutContext, properties.bindings);
+        }, properties.cdkOutContext, properties.bindings, properties.caller);
         const stack = this.stacks.get(properties.stackName);
         assertDefined(stack, `Sim CloudFormation Stack named ${properties.stackName}`);
         await stack.waitForDeployComplete();
         return stack;
     }
-    async createStackWithContext(command, cdkOutContext, bindings) {
+    async createStackWithContext(command, cdkOutContext, bindings, caller) {
         const handler = new CreateStackCommandHandler({
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
@@ -124,6 +125,7 @@ export class SimCloudFormationTemplateDeployer {
             background: this.background,
             cdkOutContext,
             bindings,
+            caller,
             exports: this.exports,
         });
         return await handler.handle(command);

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -2,6 +2,7 @@ import type { SimCloudFormationStackName } from "../stack/sim-cfn-stack.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import { type SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnTemplateFileWatchOptions } from "../watch/sim-cfn-template-watch.type.js";
 import { type SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
 export interface SimCloudFormationDeployTemplateFileProperties {
@@ -9,6 +10,15 @@ export interface SimCloudFormationDeployTemplateFileProperties {
     readonly stackName?: SimCloudFormationStackName | string | undefined;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as.
+     *
+     * Every Resource is created, updated and deleted through the command an SDK
+     * caller would reach, and this is who those commands are authorized as. Left
+     * out, they are decided as the Account root, which is what a service control
+     * policy denying an Account's root principal then denies.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * Adapt the parsed template before it is deployed, and again every time a
      * watched file changes.
@@ -42,6 +52,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly template: CfnTemplateBodyRecord;
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings } = deployment;
+        const { templatePath, parameters, bindings, caller } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -31,6 +31,7 @@ export class SimCfnTemplateFileLoader {
             template,
             parameters,
             bindings,
+            caller,
             cdkOutContext,
         };
     }

package/dist/service/cloudformation/deploy/sim-cfn-template-file-updater.js

@@ -42,6 +42,7 @@ export class SimCfnTemplateFileUpdater {
             stacks: this.stacks,
             background: this.background,
             cdkOutContext: loaded.cdkOutContext,
+            caller: loaded.caller,
         });
         await handler.handle({
             input: {

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.d.ts

@@ -0,0 +1,16 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+/**
+ * The request options a Resource operation makes its service calls with.
+ *
+ * Every simulated service takes a caller the same way, so one shape carries the
+ * deployment's principal from the Stack down to the commands that create and
+ * delete Resources. Absent where the deployment named no caller, which leaves
+ * each service to its own default of the Account root.
+ */
+export type SimCfnResourceCallerOptions = {
+    readonly caller: SimAwsCaller;
+} | undefined;
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export declare function simCfnResourceCallerOptions(caller: SimAwsCaller | undefined): SimCfnResourceCallerOptions;

package/dist/service/cloudformation/resource/caller/sim-cfn-resource-caller-options.js

@@ -0,0 +1,6 @@
+/**
+ * The request options naming a deployment's caller, or none where it has none.
+ */
+export function simCfnResourceCallerOptions(caller) {
+    return caller === undefined ? undefined : { caller };
+}

package/dist/service/cloudformation/resource/cfn/scheduler/sim-scheduler-cfn-value-adapter.js

@@ -1,3 +1,4 @@
+import { SimSchedulerScheduleGroup } from "../../../../scheduler/group/sim-scheduler-schedule-group.js";
 import { SimSchedulerSchedule } from "../../../../scheduler/schedule/sim-scheduler-schedule.js";
 /**
  * CloudFormation-facing values for a simulated schedule.
@@ -23,6 +24,51 @@ class SimSchedulerScheduleCfn {
         throw new Error(`Unsupported AWS::Scheduler::Schedule attribute ${attributeName}`);
     }
 }
+/**
+ * CloudFormation-facing values for a simulated schedule group.
+ *
+ * `Arn` is the one worth having. An identity policy granting `scheduler:`
+ * actions on the group names it, and so does the `aws:SourceArn` condition AWS
+ * recommends in a schedule execution role's trust policy.
+ */
+class SimSchedulerScheduleGroupCfn {
+    group;
+    constructor(properties) {
+        this.group = properties.group;
+    }
+    /**
+     * AWS::Scheduler::ScheduleGroup Ref returns the group's name.
+     */
+    refValue() {
+        return this.group.name;
+    }
+    /**
+     * AWS::Scheduler::ScheduleGroup attributes.
+     *
+     * The two dates come back as ISO strings. A template value is JSON, so there
+     * is nowhere for a `Date` to go, and every other date CloudFormation hands
+     * back is a string too.
+     */
+    attributeValue(attributeName) {
+        switch (attributeName) {
+            case "Arn": {
+                return this.group.arn;
+            }
+            case "State": {
+                return this.group.state;
+            }
+            case "CreationDate": {
+                return this.group.creationDate.toISOString();
+            }
+            case "LastModificationDate": {
+                return this.group.lastModificationDate.toISOString();
+            }
+            default: {
+                throw new Error(`Unsupported AWS::Scheduler::ScheduleGroup attribute ${attributeName}`);
+            }
+        }
+    }
+}
 /**
  * The CloudFormation-facing value adapter for a simulated Scheduler Resource.
  */
@@ -31,5 +77,9 @@ export function schedulerValueAdapter(properties) {
         properties.simResource instanceof SimSchedulerSchedule) {
         return new SimSchedulerScheduleCfn({ schedule: properties.simResource });
     }
+    if (properties.type === "AWS::Scheduler::ScheduleGroup" &&
+        properties.simResource instanceof SimSchedulerScheduleGroup) {
+        return new SimSchedulerScheduleGroupCfn({ group: properties.simResource });
+    }
     return undefined;
 }

package/dist/service/cloudformation/resource/resolve/property/sim-cfn-resource-property-resolver.d.ts

@@ -45,10 +45,13 @@ export declare class SimCfnResourcePropertyResolver {
      * {@link SimCfnTemplateValueResolver}. If no Parameters are available, an empty
      * Parameter resolver is used so Resource Refs can still resolve.
      *
-     * Resolution itself is synchronous, and the awaiting happens around it. A
-     * dynamic reference naming a service that has to be waited on resolves to a
-     * marker while the properties resolve, and the values replace the markers
-     * here.
+     * Resolution itself is synchronous, and the awaiting happens around it.
+     * Properties holding a dynamic reference are resolved twice: the first pass
+     * reads the references and leaves them as the template wrote them, and the
+     * second finds the answers waiting, so an intrinsic function reading a
+     * reference's value gets the value rather than a marker. A reference the
+     * first pass never reached resolves to a marker instead, and the values
+     * replace the markers here.
      *
      * Resource Refs are read from the creation context. If a referenced Resource
      * is unexpectedly absent, the Ref is preserved as `{ Ref: logicalId }` rather
@@ -61,6 +64,10 @@ export declare class SimCfnResourcePropertyResolver {
      * Absent where the caller has no simulation to read from, which is how the
      * resolver is used on its own in tests. A reference then stays in the
      * property as the template wrote it.
+     *
+     * The principal the operation runs as goes with the simulation, so a
+     * reference is read as the deployment's own caller rather than as the
+     * Account root.
      */
     private dynamicReferences;
 }

package/dist/service/cloudformation/resource/resolve/property/sim-cfn-resource-property-resolver.js

@@ -1,6 +1,7 @@
 import { SimCfnParameters } from "../../../parameters/sim-cfn-parameters.js";
 import { SimCfnTemplateValueResolver } from "../../../template/value/sim-cfn-template-value-resolver.js";
 import { makeSimCfnDynamicReferences } from "../../../template/dynamic/make-sim-cfn-dynamic-references.js";
+import { hasSimCfnDynamicReferenceIn } from "../../../template/dynamic/sim-cfn-dynamic-reference-scan.js";
 /**
  * Resolves CloudFormation Resource Properties immediately before Resource
  * creation.
@@ -36,10 +37,13 @@ export class SimCfnResourcePropertyResolver {
      * {@link SimCfnTemplateValueResolver}. If no Parameters are available, an empty
      * Parameter resolver is used so Resource Refs can still resolve.
      *
-     * Resolution itself is synchronous, and the awaiting happens around it. A
-     * dynamic reference naming a service that has to be waited on resolves to a
-     * marker while the properties resolve, and the values replace the markers
-     * here.
+     * Resolution itself is synchronous, and the awaiting happens around it.
+     * Properties holding a dynamic reference are resolved twice: the first pass
+     * reads the references and leaves them as the template wrote them, and the
+     * second finds the answers waiting, so an intrinsic function reading a
+     * reference's value gets the value rather than a marker. A reference the
+     * first pass never reached resolves to a marker instead, and the values
+     * replace the markers here.
      *
      * Resource Refs are read from the creation context. If a referenced Resource
      * is unexpectedly absent, the Ref is preserved as `{ Ref: logicalId }` rather
@@ -72,11 +76,15 @@ export class SimCfnResourcePropertyResolver {
                 },
             },
         });
-        const resolved = resolver.resolveRecord(properties);
         if (dynamicReferences === undefined) {
-            return resolved;
+            return resolver.resolveRecord(properties);
         }
-        return await dynamicReferences.settle(resolved);
+        if (hasSimCfnDynamicReferenceIn(properties)) {
+            await dynamicReferences.prefetch(() => {
+                resolver.resolveRecord(properties);
+            });
+        }
+        return await dynamicReferences.settle(resolver.resolveRecord(properties));
     }
     /**
      * The services answering this Resource's dynamic references.
@@ -84,14 +92,19 @@ export class SimCfnResourcePropertyResolver {
      * Absent where the caller has no simulation to read from, which is how the
      * resolver is used on its own in tests. A reference then stays in the
      * property as the template wrote it.
+     *
+     * The principal the operation runs as goes with the simulation, so a
+     * reference is read as the deployment's own caller rather than as the
+     * Account root.
      */
     dynamicReferences(context) {
-        const { simAws } = context;
+        const { simAws, caller } = context;
         if (simAws === undefined || this.accountRegionScope === undefined) {
             return undefined;
         }
         return makeSimCfnDynamicReferences({
             simAws,
+            caller,
             accountRegionScope: this.accountRegionScope,
             propertyIgnorer: this.propertyIgnorer,
             resourceType: this.resourceType,

package/dist/service/cloudformation/resource/sim-cfn-resource.type.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnServiceResourceFactory } from "./factory/sim-cfn-resource-factory.type.js";
@@ -43,6 +44,15 @@ export interface SimCfnResourceResolveContext {
      * another service rather than from the template. A dynamic reference is one.
      */
     readonly simAws?: SimAws | undefined;
+    /**
+     * The principal the operation runs as, which a value read out of another
+     * service is authorized as. Real CloudFormation reads a dynamic reference
+     * under the Stack's execution role rather than as the Account root.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default of the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationResourceCreateContext {
     readonly simAws: SimAws;
@@ -50,6 +60,15 @@ export interface SimCloudFormationResourceCreateContext {
     readonly resolvedProperties?: SimCfnTemplateValueRecord | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the deployment runs as, which every service command creating
+     * a Resource is authorized as.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default: the Account root, as it is everywhere else in
+     * the simulation.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * What a service is given to delete a Resource it created.
@@ -64,4 +83,6 @@ export interface SimCloudFormationResourceDeleteContext {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly resolvedProperties?: SimCfnTemplateValueRecord | undefined;
+    /** The principal the teardown runs as, as creation carries it. */
+    readonly caller?: SimAwsCaller | undefined;
 }

package/dist/service/cloudformation/sim-cloudformation.d.ts

@@ -12,7 +12,7 @@ import type { SimCloudFormationDeployTemplateFileProperties as SimCloudFormation
 import type { SimCloudFormationDeployCdkOutProperties } from "./deploy/sim-cfn-cdk-out-deployer.js";
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 /**
  * Options accepted by simulated CloudFormation command operations.
  */

package/dist/service/cloudformation/sim-cloudformation.js

@@ -8,7 +8,7 @@ import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-s
 import { SimCfnExports } from "./export/sim-cfn-exports.js";
 import { SimCloudFormationSdkCommandRouter } from "./sdk/sim-cloudformation-sdk-command-router.js";
 import { SimCloudFormationAuthorization } from "./authorize/sim-cloudformation-authorization.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 /**
  * Simulated CloudFormation in one AWS Account and Region.
  */
@@ -22,7 +22,8 @@ export class SimCloudFormation {
     sdkRouter = new SimCloudFormationSdkCommandRouter(this);
     authorization;
     constructor(properties) {
-        const { simAws, accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background, } = properties;
+        const { simAws, accountRegionScope = simAwsAccountRegionScopeFactory.make(), background, } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.simAws = simAws;
         this.background = background;
         this.accountRegionScope = accountRegionScope;

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
@@ -7,6 +8,7 @@ interface SimCfnStackResourceBatchCreatorProperties {
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Creates one dependency-ready batch of Stack Resources.
@@ -27,6 +29,7 @@ export declare class SimCfnStackResourceBatchCreator {
     private readonly resources;
     private readonly cdkOutContext;
     private readonly bindings;
+    private readonly caller;
     constructor(properties: SimCfnStackResourceBatchCreatorProperties);
     /**
      * Create the supplied Resources concurrently.