@kensio/yulin 1.20.14 → 1.20.15

package/dist/service/lambda/function/code/vm/sim-lambda-vm-modules.js

@@ -1,6 +1,8 @@
-import { createRequire, isBuiltin } from "node:module";
+import { isBuiltin } from "node:module";
 import path from "node:path";
 import vm from "node:vm";
+import { requireHostModule } from "./sim-lambda-host-modules.js";
+import { provideSdkModule } from "./sdk/sim-lambda-provided-sdk-module.js";
 import { loadJsonModule } from "./sim-lambda-vm-json-module.js";
 import { SimLambdaVmModuleResolver } from "./sim-lambda-vm-module-resolver.js";
 import { userCodeSyntaxError } from "./sim-lambda-vm-syntax-error.js";
@@ -9,7 +11,6 @@ import { userCodeSyntaxError } from "./sim-lambda-vm-syntax-error.js";
  * bounded like real Lambda bounds its init phase.
  */
 const moduleEvaluationTimeoutMs = 5000;
-const hostRequire = createRequire(import.meta.url);
 /**
  * A CommonJS module system over a sim Lambda function code zip archive.
  *
@@ -35,7 +36,7 @@ export class SimLambdaVmModules {
         // those too. Anything it declines is the host built-in itself.
         if (isBuiltin(specifier)) {
             return (this.properties.sdkModuleProvider.provideModule(specifier) ??
-                hostRequire(specifier));
+                requireHostModule(specifier));
         }
         let filePath;
         try {
@@ -59,7 +60,7 @@ export class SimLambdaVmModules {
      * original archive resolution error is reported.
      */
     provideModule(specifier, archiveError) {
-        const provided = this.properties.sdkModuleProvider.provideModule(specifier);
+        const provided = provideSdkModule(specifier, this.properties);
         if (provided === undefined) {
             throw archiveError;
         }

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js

@@ -28,7 +28,10 @@ export class PutBucketPolicyCommandHandler {
     async handle(command, options) {
         assertDefined(command.input.Bucket, "PutBucketPolicyCommand.input.Bucket");
         assertDefined(command.input.Policy, "PutBucketPolicyCommand.input.Policy");
-        this.policyValidator.validateRequired(command.input.Policy);
+        this.policyValidator.validateRequired(command.input.Policy, {
+            attachedTo: "Bucket",
+            name: command.input.Bucket,
+        });
         const bucketName = command.input.Bucket;
         const bucket = requireSimS3Bucket(this.buckets, bucketName);
         await this.background.sequence();

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.d.ts

@@ -6,6 +6,13 @@ interface SimSchedulerDeliveryFailureProperties {
     readonly at: Date;
     readonly error: unknown;
 }
+/**
+ * A failed invocation as it serialises. Every property the failure holds, plus
+ * the message the getter reads off the error.
+ */
+export interface SimSchedulerDeliveryFailureJson extends SimSchedulerDeliveryFailureProperties {
+    readonly message: string;
+}
 /**
  * One invocation a schedule could not make.
  */
@@ -28,6 +35,15 @@ export declare class SimSchedulerDeliveryFailure {
      * What went wrong, as a message.
      */
     get message(): string;
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a schedule did
+     * not do what a test expected. The message is a getter on the prototype and
+     * would be left out. An Error keeps its own message on a non-enumerable
+     * property and prints as `{}`.
+     */
+    toJSON(): SimSchedulerDeliveryFailureJson;
 }
 /**
  * Every invocation one simulated Scheduler scope could not make.

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.js

@@ -32,6 +32,25 @@ export class SimSchedulerDeliveryFailure {
         }
         return String(this.error);
     }
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a schedule did
+     * not do what a test expected. The message is a getter on the prototype and
+     * would be left out. An Error keeps its own message on a non-enumerable
+     * property and prints as `{}`.
+     */
+    toJSON() {
+        return {
+            scheduleName: this.scheduleName,
+            scheduleArn: this.scheduleArn,
+            targetArn: this.targetArn,
+            roleArn: this.roleArn,
+            at: this.at,
+            message: this.message,
+            error: this.error,
+        };
+    }
 }
 /**
  * Every invocation one simulated Scheduler scope could not make.

package/dist/service/scheduler/index.d.ts

@@ -10,6 +10,6 @@ export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expr
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, type SimSchedulerTargetService, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, type SimSchedulerDeliveryTargets, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, type SimSchedulerDeliveryFailureJson, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/scheduler/index.js

@@ -9,6 +9,6 @@ export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expr
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSecretsManager } from "../../sim-secrets-manager.js";
@@ -6,16 +7,19 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
     readonly secretsManager: SimSecretsManager;
     /** Secrets Manager for another Account and Region, which a full ARN names. */
     readonly secretsManagerIn: (scope: SimAwsAccountRegionScope) => SimSecretsManager;
+    /** The principal the deployment runs as, which the secret is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -29,22 +33,16 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
 export declare class SimCfnSecretsManagerDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly secretsManager;
     private readonly secretsManagerIn;
+    private readonly callerOptions;
     constructor(properties: SimCfnSecretsManagerDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the secret value it names.
      */
     resolve(reference: SimCfnDynamicReference): Promise<SimCfnDynamicReferenceResolution>;
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    private read;
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    private standIn;
+    private secretsManagerFor;
 }
 export {};

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.js

@@ -1,15 +1,18 @@
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSecretsManagerError } from "../../error/sim-secrets-manager.error.js";
-import { simCfnSecretsManagerJsonKeyValue } from "./sim-cfn-secrets-manager-json-key.js";
+import { simCfnSecretsManagerReferenceStandIn } from "./sim-cfn-secrets-manager-reference-stand-in.js";
+import { simCfnSecretsManagerReferenceValue } from "./sim-cfn-secrets-manager-reference-value.js";
 import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProblem, } from "./sim-cfn-secrets-manager-reference-body.js";
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -23,9 +26,11 @@ import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProble
 export class SimCfnSecretsManagerDynamicReferenceResolver {
     secretsManager;
     secretsManagerIn;
+    callerOptions;
     constructor(properties) {
         this.secretsManager = properties.secretsManager;
         this.secretsManagerIn = properties.secretsManagerIn;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the secret value it names.
@@ -35,54 +40,28 @@ export class SimCfnSecretsManagerDynamicReferenceResolver {
         try {
             const parsed = parseSimCfnSecretsManagerReference(reference.body);
             secretId = parsed.secretId;
-            return { value: await this.read(parsed) };
+            return {
+                value: await simCfnSecretsManagerReferenceValue(this.secretsManagerFor(parsed.scope), parsed, this.callerOptions),
+            };
         }
         catch (error) {
             if (error instanceof SimCfnSecretsManagerReferenceProblem) {
-                return this.standIn(reference, secretId, error.message);
+                return simCfnSecretsManagerReferenceStandIn(reference, secretId, error.message);
             }
             /* v8 ignore next 3 -- defensive: only Secrets Manager reaches here */
             if (!(error instanceof SimSecretsManagerError)) {
                 throw error;
             }
-            return this.standIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
+            return simCfnSecretsManagerReferenceStandIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
         }
     }
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    async read(reference) {
-        const { secretId, scope, jsonKey, versionStage, versionId } = reference;
-        const secretsManager = scope === undefined ? this.secretsManager : this.secretsManagerIn(scope);
-        const read = await secretsManager.getSecretValue({
-            input: {
-                SecretId: secretId,
-                VersionStage: versionStage,
-                VersionId: versionId,
-            },
-        });
-        const secretString = read.SecretString;
-        if (secretString === undefined) {
-            throw new SimCfnSecretsManagerReferenceProblem(`and '${secretId}' holds a binary value, which a dynamic reference ` +
-                `cannot read`);
-        }
-        if (jsonKey === undefined) {
-            return secretString;
-        }
-        return simCfnSecretsManagerJsonKeyValue(secretString, secretId, jsonKey);
-    }
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    standIn(reference, secretId, reason) {
-        return {
-            value: `dummy-value-for-${secretId}`,
-            reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
-                `with a stand-in value`,
-        };
+    secretsManagerFor(scope) {
+        return scope === undefined
+            ? this.secretsManager
+            : this.secretsManagerIn(scope);
     }
 }

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.d.ts

@@ -0,0 +1,9 @@
+import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export declare function simCfnSecretsManagerReferenceStandIn(reference: SimCfnDynamicReference, secretId: string, reason: string): SimCfnDynamicReferenceResolution;

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.js

@@ -0,0 +1,14 @@
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export function simCfnSecretsManagerReferenceStandIn(reference, secretId, reason) {
+    return {
+        value: `dummy-value-for-${secretId}`,
+        reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
+            `with a stand-in value`,
+    };
+}

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-value.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+import { type SimCfnSecretsManagerReference } from "./sim-cfn-secrets-manager-reference-body.js";
+/**
+ * The secret value one parsed reference names.
+ *
+ * The version the reference selects, or the current one, read through the
+ * ordinary GetSecretValue command as the principal the deployment named. That
+ * decrypts the version through simulated KMS, which is why reading a secret
+ * has to be waited on.
+ */
+export declare function simCfnSecretsManagerReferenceValue(secretsManager: SimSecretsManager, reference: SimCfnSecretsManagerReference, callerOptions: SimCfnResourceCallerOptions): Promise<string>;

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-value.js

@@ -0,0 +1,29 @@
+import { simCfnSecretsManagerJsonKeyValue } from "./sim-cfn-secrets-manager-json-key.js";
+import { SimCfnSecretsManagerReferenceProblem, } from "./sim-cfn-secrets-manager-reference-body.js";
+/**
+ * The secret value one parsed reference names.
+ *
+ * The version the reference selects, or the current one, read through the
+ * ordinary GetSecretValue command as the principal the deployment named. That
+ * decrypts the version through simulated KMS, which is why reading a secret
+ * has to be waited on.
+ */
+export async function simCfnSecretsManagerReferenceValue(secretsManager, reference, callerOptions) {
+    const { secretId, jsonKey, versionStage, versionId } = reference;
+    const read = await secretsManager.getSecretValue({
+        input: {
+            SecretId: secretId,
+            VersionStage: versionStage,
+            VersionId: versionId,
+        },
+    }, callerOptions);
+    const secretString = read.SecretString;
+    if (secretString === undefined) {
+        throw new SimCfnSecretsManagerReferenceProblem(`and '${secretId}' holds a binary value, which a dynamic reference ` +
+            `cannot read`);
+    }
+    if (jsonKey === undefined) {
+        return secretString;
+    }
+    return simCfnSecretsManagerJsonKeyValue(secretString, secretId, jsonKey);
+}

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.d.ts

@@ -1,16 +1,26 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -18,14 +28,20 @@ interface SimCfnSsmDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the parameter value it names.
      */
-    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution;
+    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution | Promise<SimCfnDynamicReferenceResolution>;
     /**
      * Read the version the reference selects, or the current one.
      */
     private parameterValue;
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    private readValue;
 }
 export {};

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.js

@@ -1,14 +1,25 @@
-import { SimSsmParameterVersionNotFound } from "../../error/sim-ssm.error.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
+/** The parameter type a plain `ssm` reference leaves to `ssm-secure`. */
+const secureString = "SecureString";
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -16,8 +27,10 @@ import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
  */
 export class SimCfnSsmDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the parameter value it names.
@@ -28,33 +41,35 @@ export class SimCfnSsmDynamicReferenceResolver {
             return simCfnSsmReferenceStandIn(reference, reference.body, `which is not the parameter name, optionally followed by an integer ` +
                 `version, that an ssm dynamic reference takes`);
         }
-        const { name, version } = parsed;
-        const parameter = this.ssm.findParameter(name);
-        if (parameter === undefined) {
-            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store holds no parameter '${name}'`);
-        }
-        if (parameter.type.value === "SecureString") {
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
-                `through an ssm-secure reference`);
-        }
-        return this.parameterValue(reference, parameter, name, version);
+        return this.parameterValue(reference, parsed.name, parsed.version);
     }
     /**
      * Read the version the reference selects, or the current one.
      */
-    parameterValue(reference, parameter, name, version) {
-        if (version === undefined) {
-            return { value: parameter.currentVersion.value.value };
-        }
+    async parameterValue(reference, name, version) {
+        const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            return { value: parameter.versionNumbered(Number(version)).value.value };
+            const read = await this.ssm.getParameter({ input: { Name: selector } }, this.callerOptions);
+            assertDefined(read.Parameter, `the parameter read for '${name}'`);
+            return this.readValue(reference, name, read.Parameter);
         }
         catch (error) {
-            /* v8 ignore next 3 -- defensive: only a missing version reaches here */
-            if (!(error instanceof SimSsmParameterVersionNotFound)) {
+            if (!(error instanceof SimSsmError)) {
                 throw error;
             }
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' has no version ${version}`);
+            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store could not read it (${error.message})`);
+        }
+    }
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    readValue(reference, name, parameter) {
+        if (parameter.Type === secureString) {
+            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
+                `through an ssm-secure reference`);
         }
+        assertDefined(parameter.Value, `the value read for '${name}'`);
+        return { value: parameter.Value };
     }
 }

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.d.ts

@@ -1,18 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver, SimCfnDynamicReferenceSite } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmSecureDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm-secure:...}}` references from the simulated Parameter
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,6 +26,7 @@ interface SimCfnSsmSecureDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmSecureDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmSecureDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the decrypted parameter value it names.

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.js

@@ -1,4 +1,5 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
@@ -8,11 +9,12 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,8 +24,10 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  */
 export class SimCfnSsmSecureDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the decrypted parameter value it names.
@@ -47,9 +51,7 @@ export class SimCfnSsmSecureDynamicReferenceResolver {
     async decrypted(reference, name, version) {
         const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            const read = await this.ssm.getParameter({
-                input: { Name: selector, WithDecryption: true },
-            });
+            const read = await this.ssm.getParameter({ input: { Name: selector, WithDecryption: true } }, this.callerOptions);
             const parameter = read.Parameter;
             assertDefined(parameter, `the parameter read for '${name}'`);
             requireSecureStringParameter(name, parameter);

package/dist/service/ssm/sim-ssm.d.ts

@@ -86,12 +86,20 @@ export declare class SimSsm {
     cfnResourceFactory(): SimSsmCfnResourceFactory;
     /**
      * Get the resolver for `{{resolve:ssm:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnDynamicReferenceResolver(): SimCfnSsmDynamicReferenceResolver;
+    cfnDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmDynamicReferenceResolver;
     /**
      * Get the resolver for `{{resolve:ssm-secure:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnSecureDynamicReferenceResolver(): SimCfnSsmSecureDynamicReferenceResolver;
+    cfnSecureDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmSecureDynamicReferenceResolver;
     /**
      * Get the reader for `AWS::SSM::Parameter::Value<...>` template Parameters.
      */