@kensio/yulin 1.20.14 → 1.20.16

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,6 +1,6 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
@@ -85,6 +85,7 @@ interface SimIamAuthZContextBuilderProperties {
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation, for the identity side
      * of a cross-Account request.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -43,7 +43,11 @@ export class SimIamAuthZContextBuilder {
     derivedConditions = new SimIamDerivedConditions();
     scpSourceBuilder;
     constructor(properties) {
-        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder({
+            accountRootPrincipal: makeSimAwsAccountRootPrincipal(properties.accountId),
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
+        });
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
             policies: properties.policies,
             roles: properties.roles,

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -47,8 +47,18 @@ export declare class SimIamPolicyPrincipalMatcher {
      * The wildcard matches both authenticated and anonymous requests. Other AWS
      * forms require an ARN-based caller. Account delegation forms compare against
      * the account ID derived by the caller resolver.
+     *
+     * A pattern is compared against two ARNs, because an assumed-role session
+     * has two. The session ARN is the caller, and the Role behind it is the
+     * identity whose policies apply. AWS matches a policy naming either one, and
+     * recommends naming the Role. The two ARNs are the same for every caller
+     * that is not a session, so one comparison happens in that case.
      */
     private awsPatternMatches;
+    /**
+     * Whether a principal pattern names one of the caller's ARNs.
+     */
+    private arnMatches;
     /**
      * Compare a service principal pattern with the resolved caller.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -81,6 +81,12 @@ export class SimIamPolicyPrincipalMatcher {
      * The wildcard matches both authenticated and anonymous requests. Other AWS
      * forms require an ARN-based caller. Account delegation forms compare against
      * the account ID derived by the caller resolver.
+     *
+     * A pattern is compared against two ARNs, because an assumed-role session
+     * has two. The session ARN is the caller, and the Role behind it is the
+     * identity whose policies apply. AWS matches a policy naming either one, and
+     * recommends naming the Role. The two ARNs are the same for every caller
+     * that is not a session, so one comparison happens in that case.
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
@@ -94,9 +100,15 @@ export class SimIamPolicyPrincipalMatcher {
         if (delegatedAccountId !== undefined) {
             return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return SimIamPrincipalMatch.direct().when(simIamWildcardMatch(pattern, caller.arn, {
-            caseSensitive: true,
-        }));
+        return SimIamPrincipalMatch.direct().when(this.arnMatches(pattern, caller.arn) ||
+            this.arnMatches(pattern, caller.identityPolicyArn));
+    }
+    /**
+     * Whether a principal pattern names one of the caller's ARNs.
+     */
+    arnMatches(pattern, arn) {
+        return (arn !== undefined &&
+            simIamWildcardMatch(pattern, arn, { caseSensitive: true }));
     }
     /**
      * Compare a service principal pattern with the resolved caller.

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -1,7 +1,7 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
@@ -17,6 +17,12 @@ interface SimIamAccountAuthZProperties {
     readonly roles: Map<SimIamRoleName, SimIamRole>;
     readonly users: Map<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     *
+     * Left out, such a request is decided as this Account's root principal.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation.
      *
@@ -37,9 +43,10 @@ interface SimIamAccountAuthZProperties {
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the root principal of
- * the owning sim Account. An explicit anonymous caller suppresses that
- * fallback and is evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the simulation's default
+ * caller, and to the root principal of the owning sim Account where the
+ * simulation has none. An explicit anonymous caller suppresses both and is
+ * evaluated without identity policies.
  */
 export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -3,9 +3,10 @@ import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the root principal of
- * the owning sim Account. An explicit anonymous caller suppresses that
- * fallback and is evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the simulation's default
+ * caller, and to the root principal of the owning sim Account where the
+ * simulation has none. An explicit anonymous caller suppresses both and is
+ * evaluated without identity policies.
  */
 export class SimIamAccountAuthZ {
     properties;
@@ -38,6 +39,7 @@ export class SimIamAccountAuthZ {
             roles: this.properties.roles,
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
+            defaultCaller: this.properties.defaultCaller,
             iamResolver: this.properties.iamResolver,
             scpResolver: this.properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -3,7 +3,7 @@ import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
@@ -17,6 +17,7 @@ interface SimIamAuthorizerProperties {
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     readonly iamResolver?: SimIamAccountResolver | undefined;
     readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -17,6 +17,7 @@ export class SimIamAuthorizer {
             roles: properties.roles,
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/command/policy/create-policy/create-policy-input-resolver.js

@@ -26,7 +26,10 @@ export class CreatePolicyInputResolver {
         if (policyName === undefined || policyName.length === 0) {
             throw new Error("PolicyName is required");
         }
-        this.policyDocValidator.validateOptional(command.input.PolicyDocument);
+        this.policyDocValidator.validateOptional(command.input.PolicyDocument, {
+            attachedTo: "Policy",
+            name: policyName,
+        });
         const path = normalisePolicyPath(command.input.Path);
         const arn = makeSimPolicyArn({
             accountId: this.accountId,

package/dist/service/iam/command/policy/put-role-policy/put-role-policy.handler.js

@@ -33,7 +33,11 @@ export class PutRolePolicyCommandHandler {
             throw new Error("PolicyName is required");
         }
         const policyDocument = command.input.PolicyDocument;
-        this.policyDocValidator.validateRequired(policyDocument);
+        this.policyDocValidator.validateRequired(policyDocument, {
+            attachedTo: "Role",
+            name: roleName,
+            policyName,
+        });
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const role = this.roles.get(roleName);

package/dist/service/iam/command/policy/put-user-policy/put-user-policy.handler.js

@@ -29,7 +29,11 @@ export class PutUserPolicyCommandHandler {
         const policyName = command.input.PolicyName;
         assertDefined(policyName, "PutUserPolicyCommand.input.PolicyName");
         const policyDocument = command.input.PolicyDocument;
-        this.policyDocValidator.validateRequired(policyDocument);
+        this.policyDocValidator.validateRequired(policyDocument, {
+            attachedTo: "User",
+            name: username,
+            policyName,
+        });
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const user = this.users.get(username);

package/dist/service/iam/policy/parse/sim-iam-document-parser.d.ts

@@ -19,6 +19,10 @@ export interface SimIamParsedPolicyStatement {
  *
  * IAM policy JSON commonly allows either a single value or an array. The decision
  * engine should not need to care which source shape was used.
+ *
+ * A document stored without validation can hold a value of the wrong type in
+ * one of those fields. Parsing it reports a malformed policy naming the
+ * statement.
  */
 export declare class SimIamPolicyDocumentParser {
     /**
@@ -26,5 +30,4 @@ export declare class SimIamPolicyDocumentParser {
      */
     parse(policy: SimIamPolicyDocument): SimIamParsedPolicyDocument;
     private parseStatement;
-    private stringList;
 }

package/dist/service/iam/policy/parse/sim-iam-document-parser.js

@@ -1,9 +1,15 @@
 import { simIamPolicyDocumentStatements } from "../sim-iam-pol-document-statements.js";
+import { simIamStatementLabel } from "../sim-iam-statement-label.js";
+import { simIamStatementStrings } from "../sim-iam-statement-strings.js";
 /**
  * Parse raw IAM policy document shapes into a form convenient for evaluation.
  *
  * IAM policy JSON commonly allows either a single value or an array. The decision
  * engine should not need to care which source shape was used.
+ *
+ * A document stored without validation can hold a value of the wrong type in
+ * one of those fields. Parsing it reports a malformed policy naming the
+ * statement.
  */
 export class SimIamPolicyDocumentParser {
     /**
@@ -11,30 +17,22 @@ export class SimIamPolicyDocumentParser {
      */
     parse(policy) {
         return {
-            statements: simIamPolicyDocumentStatements(policy).map((statement) => this.parseStatement(statement)),
+            statements: simIamPolicyDocumentStatements(policy).map((statement, index) => this.parseStatement(statement, index)),
         };
     }
-    parseStatement(statement) {
+    parseStatement(statement, index) {
+        const label = simIamStatementLabel(index);
         return {
             source: statement,
             sid: statement.Sid,
             effect: statement.Effect,
-            actions: this.stringList(statement.Action),
-            notActions: this.stringList(statement.NotAction),
-            resources: this.stringList(statement.Resource),
-            notResources: this.stringList(statement.NotResource),
+            actions: simIamStatementStrings(statement.Action, label, "Action"),
+            notActions: simIamStatementStrings(statement.NotAction, label, "NotAction"),
+            resources: simIamStatementStrings(statement.Resource, label, "Resource"),
+            notResources: simIamStatementStrings(statement.NotResource, label, "NotResource"),
             principal: statement.Principal,
             notPrincipal: statement.NotPrincipal,
             condition: statement.Condition,
         };
     }
-    stringList(value) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value === "string") {
-            return [value];
-        }
-        return [...value];
-    }
 }

package/dist/service/iam/policy/sim-iam-statement-label.d.ts

@@ -0,0 +1,28 @@
+/**
+ * What a policy document is attached to, for naming it when one of its
+ * statements is rejected.
+ */
+export interface SimIamPolicyDocumentSubject {
+    /**
+     * The kind of thing the document is attached to, such as `Role` or `Bucket`.
+     */
+    readonly attachedTo: string;
+    /**
+     * The name of the thing the document is attached to.
+     */
+    readonly name: string;
+    /**
+     * The policy's own name, for a document stored under one.
+     */
+    readonly policyName?: string | undefined;
+}
+/**
+ * Name one statement of a policy document, for a message about what is wrong
+ * with it.
+ *
+ * A malformed statement usually arrives from a CloudFormation template. The
+ * reader chasing one back needs the document it came from as well as the fault
+ * in it. Statements carry no names of their own. The position in the document
+ * stands in for one.
+ */
+export declare function simIamStatementLabel(index: number, subject?: SimIamPolicyDocumentSubject): string;

package/dist/service/iam/policy/sim-iam-statement-label.js

@@ -0,0 +1,17 @@
+/**
+ * Name one statement of a policy document, for a message about what is wrong
+ * with it.
+ *
+ * A malformed statement usually arrives from a CloudFormation template. The
+ * reader chasing one back needs the document it came from as well as the fault
+ * in it. Statements carry no names of their own. The position in the document
+ * stands in for one.
+ */
+export function simIamStatementLabel(index, subject) {
+    const statement = `statement ${index + 1}`;
+    if (subject === undefined) {
+        return `IAM policy ${statement}`;
+    }
+    const policy = subject.policyName === undefined ? "" : ` policy "${subject.policyName}"`;
+    return `${subject.attachedTo} "${subject.name}"${policy} ${statement}`;
+}

package/dist/service/iam/policy/sim-iam-statement-strings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read a statement field holding either one string or a list of strings.
+ *
+ * Action, NotAction, Resource and NotResource each take either shape, and
+ * anything else is a malformed document. An unresolved CloudFormation intrinsic
+ * is the usual way one arrives. The IAM policy parsers store `PolicyDocument`
+ * whole, and a `Ref` or `Fn::GetAtt` nested inside a statement is kept as
+ * written. Refusing it here keeps it out of evaluation, where the same value
+ * surfaces as a `TypeError` naming no policy.
+ */
+export declare function simIamStatementStrings(value: unknown, label: string, field: string): readonly string[] | undefined;

package/dist/service/iam/policy/sim-iam-statement-strings.js

@@ -0,0 +1,27 @@
+import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
+/**
+ * Read a statement field holding either one string or a list of strings.
+ *
+ * Action, NotAction, Resource and NotResource each take either shape, and
+ * anything else is a malformed document. An unresolved CloudFormation intrinsic
+ * is the usual way one arrives. The IAM policy parsers store `PolicyDocument`
+ * whole, and a `Ref` or `Fn::GetAtt` nested inside a statement is kept as
+ * written. Refusing it here keeps it out of evaluation, where the same value
+ * surfaces as a `TypeError` naming no policy.
+ */
+export function simIamStatementStrings(value, label, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (isStringArray(value)) {
+        return [...value];
+    }
+    throw new SimIamMalformedPolicyDocument(`${label}: ${field} must be a string or an array of strings, but holds ${JSON.stringify(value)}`);
+}
+function isStringArray(value) {
+    return (Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string"));
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -1,5 +1,6 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
 /**
  * What a test asks for when it wants a Role that may do something.
@@ -13,6 +14,14 @@ export interface SimIamRoleWithPolicyInput {
     readonly policyName: string;
     readonly actions: readonly string[];
     readonly resource: string;
+    /**
+     * The principal creating the Role.
+     *
+     * A simulation given a default caller attributes these two commands to it,
+     * and a Role being created for that caller has no policies to allow them
+     * yet. Naming the Account root here is how such a test bootstraps.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * The Role a CreateRole request answers with.

package/dist/service/iam/role/sim-iam-role-with-policy.factory.js

@@ -24,8 +24,10 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
     policyName: "ApplicationPolicy",
     actions: [],
     resource: "*",
+    caller: undefined,
 }), async (input, simAws) => {
     const simIam = simAws.iam();
+    const options = input.caller === undefined ? undefined : { caller: input.caller };
     const creation = await simIam.createRole({
         input: {
             RoleName: input.roleName,
@@ -38,7 +40,7 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 },
             }),
         },
-    });
+    }, options);
     await simIam.putRolePolicy({
         input: {
             RoleName: input.roleName,
@@ -47,6 +49,6 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 Statement: { Action: input.actions, Resource: input.resource },
             }),
         },
-    });
+    }, options);
     return creation.Role;
 });

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -1,6 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimAwsDefaultCaller } from "../aws/caller/sim-aws-caller.js";
 import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
@@ -19,6 +20,13 @@ export interface SimIamProperties {
     readonly credentialRegistry?: SimIamCredentialRegistry;
     readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
     readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     *
+     * A SimAws passes on what it was built with. Left out, such a request is
+     * decided as the Account root, which is what a standalone SimIam does.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves the IAM of other Accounts in the same simulation.
      *

package/dist/service/iam/sim-iam-account-parts.js

@@ -47,6 +47,7 @@ export class SimIamAccountParts {
             roles: this.roles,
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
+            defaultCaller: properties.defaultCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/validate/sim-iam-policy-document-validator.d.ts

@@ -1,17 +1,24 @@
 import { type JSONString } from "../../../util/type-guard/json.js";
 import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+import { type SimIamPolicyDocumentSubject } from "../policy/sim-iam-statement-label.js";
 /**
  * Performs basic IAM policy document validation shared by IAM policy commands.
+ *
+ * A caller can say what the document is attached to, and a rejection names it.
+ * Malformed documents usually arrive from a CloudFormation template, and the
+ * failure has to carry enough for a reader to find the template that wrote
+ * it.
  */
 export declare class SimIamPolicyDocumentValidator {
     /**
      * Validate a required JSON IAM policy document string.
      */
-    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    validateRequired(policyDocument: string | undefined, subject?: SimIamPolicyDocumentSubject): asserts policyDocument is JSONString<SimIamPolicyDocument>;
     /**
      * Validate an optional JSON IAM policy document string when present.
      */
-    validateOptional(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
+    validateOptional(policyDocument: string | undefined, subject?: SimIamPolicyDocumentSubject): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
     private validate;
     private validateParsed;
+    private validateStatement;
 }

package/dist/service/iam/validate/sim-iam-policy-document-validator.js

@@ -1,45 +1,63 @@
 import { jsonParse } from "../../../util/type-guard/json.js";
 import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
 import { simIamPolicyDocumentStatements } from "../policy/sim-iam-pol-document-statements.js";
+import { simIamStatementLabel, } from "../policy/sim-iam-statement-label.js";
+import { simIamStatementStrings } from "../policy/sim-iam-statement-strings.js";
 /**
  * Performs basic IAM policy document validation shared by IAM policy commands.
+ *
+ * A caller can say what the document is attached to, and a rejection names it.
+ * Malformed documents usually arrive from a CloudFormation template, and the
+ * failure has to carry enough for a reader to find the template that wrote
+ * it.
  */
 export class SimIamPolicyDocumentValidator {
     /**
      * Validate a required JSON IAM policy document string.
      */
-    validateRequired(policyDocument) {
+    validateRequired(policyDocument, subject) {
         if (policyDocument === undefined || policyDocument.length === 0) {
             throw new Error("PolicyDocument is required");
         }
-        this.validate(policyDocument);
+        this.validate(policyDocument, subject);
     }
     /**
      * Validate an optional JSON IAM policy document string when present.
      */
-    validateOptional(policyDocument) {
+    validateOptional(policyDocument, subject) {
         if (policyDocument === undefined || policyDocument.length === 0) {
             return;
         }
-        this.validate(policyDocument);
+        this.validate(policyDocument, subject);
     }
-    validate(policyDocument) {
+    validate(policyDocument, subject) {
         const parsedPolicyDocument = jsonParse(policyDocument);
-        this.validateParsed(parsedPolicyDocument);
+        this.validateParsed(parsedPolicyDocument, subject);
     }
-    validateParsed(policyDocument) {
-        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
-            // oxlint-disable-next-line typescript/no-unnecessary-condition
-            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
-                throw new SimIamMalformedPolicyDocument('IAM policy statement Effect must be either "Allow" or "Deny"');
-            }
-            if (statement.Action === undefined && statement.NotAction === undefined) {
-                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Action or NotAction");
-            }
-            if (statement.Resource === undefined &&
-                statement.NotResource === undefined) {
-                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Resource or NotResource");
-            }
+    validateParsed(policyDocument, subject) {
+        const statements = simIamPolicyDocumentStatements(policyDocument);
+        for (const [index, statement] of statements.entries()) {
+            this.validateStatement(statement, simIamStatementLabel(index, subject));
         }
     }
+    validateStatement(statement, label) {
+        // oxlint-disable-next-line typescript/no-unnecessary-condition
+        if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+            throw new SimIamMalformedPolicyDocument(`${label}: Effect must be either "Allow" or "Deny"`);
+        }
+        if (statement.Action === undefined && statement.NotAction === undefined) {
+            throw new SimIamMalformedPolicyDocument(`${label}: must define either Action or NotAction`);
+        }
+        if (statement.Resource === undefined &&
+            statement.NotResource === undefined) {
+            throw new SimIamMalformedPolicyDocument(`${label}: must define either Resource or NotResource`);
+        }
+        // Read for the types alone. A field of the wrong type throws while the
+        // document is still beside the call that wrote it. Left to the first
+        // authorization, the same fault names no policy at all.
+        simIamStatementStrings(statement.Action, label, "Action");
+        simIamStatementStrings(statement.NotAction, label, "NotAction");
+        simIamStatementStrings(statement.Resource, label, "Resource");
+        simIamStatementStrings(statement.NotResource, label, "NotResource");
+    }
 }

package/dist/service/lambda/function/code/sim-lambda-vm-zip-function.factory.d.ts

@@ -2,6 +2,7 @@ import { MappedFactory } from "@kensio/part-factory";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { SimLambdaFunction } from "../sim-lambda-function.js";
 import { type LambdaCodeZipFiles } from "./make-lambda-code-zip.js";
+import type { SimLambdaVmSdkModuleProvider } from "./vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 /**
  * What a test asks for when it wants a function backed by zip code running in
  * a vm sandbox.
@@ -16,6 +17,12 @@ export interface SimLambdaVmZipFunctionInput {
     readonly code: string | LambdaCodeZipFiles;
     readonly handlerName: string;
     readonly memorySizeMb: number;
+    /**
+     * What provides the modules the archive does not bundle, as the real
+     * runtime provides the AWS SDK. Left out, the code has none, and an SDK
+     * require is refused for want of one.
+     */
+    readonly sdkModuleProvider?: SimLambdaVmSdkModuleProvider | undefined;
 }
 /**
  * Builds a simulated Lambda function whose code is a real zip archive run in a

package/dist/service/lambda/function/code/sim-lambda-vm-zip-function.factory.js

@@ -39,6 +39,7 @@ export const simLambdaVmZipFunctionFactory = new MappedFactory(() => ({
             archive,
             handlerName: input.handlerName,
             environment,
+            sdkModuleProvider: input.sdkModuleProvider,
         }),
     });
 });

package/dist/service/lambda/function/code/vm/sdk/sim-lambda-provided-sdk-module.d.ts

@@ -0,0 +1,19 @@
+import type { SimZipArchive } from "../../../../../../util/zip/zip-archive.js";
+import type { SimLambdaVmSdkModuleProvider } from "./sim-lambda-vm-sdk-module-provider.js";
+/**
+ * What the archive holds and who provides for what it does not. Between them
+ * that is enough to tell an absent package from one already accounted for.
+ */
+interface SimLambdaMissingSdkPackagesContext {
+    readonly archive: SimZipArchive;
+    readonly sdkModuleProvider: SimLambdaVmSdkModuleProvider;
+}
+/**
+ * The module the runtime provides for a specifier the archive does not
+ * bundle, or undefined for a specifier the provider does not serve.
+ *
+ * A package the project has not installed is refused here naming every other
+ * AWS SDK package the function code imports and the project is missing too.
+ */
+export declare function provideSdkModule(specifier: string, context: SimLambdaMissingSdkPackagesContext): unknown;
+export {};