@kensio/yulin 1.20.14 → 1.20.16

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-value.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+import { type SimCfnSecretsManagerReference } from "./sim-cfn-secrets-manager-reference-body.js";
+/**
+ * The secret value one parsed reference names.
+ *
+ * The version the reference selects, or the current one, read through the
+ * ordinary GetSecretValue command as the principal the deployment named. That
+ * decrypts the version through simulated KMS, which is why reading a secret
+ * has to be waited on.
+ */
+export declare function simCfnSecretsManagerReferenceValue(secretsManager: SimSecretsManager, reference: SimCfnSecretsManagerReference, callerOptions: SimCfnResourceCallerOptions): Promise<string>;

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-value.js

@@ -0,0 +1,29 @@
+import { simCfnSecretsManagerJsonKeyValue } from "./sim-cfn-secrets-manager-json-key.js";
+import { SimCfnSecretsManagerReferenceProblem, } from "./sim-cfn-secrets-manager-reference-body.js";
+/**
+ * The secret value one parsed reference names.
+ *
+ * The version the reference selects, or the current one, read through the
+ * ordinary GetSecretValue command as the principal the deployment named. That
+ * decrypts the version through simulated KMS, which is why reading a secret
+ * has to be waited on.
+ */
+export async function simCfnSecretsManagerReferenceValue(secretsManager, reference, callerOptions) {
+    const { secretId, jsonKey, versionStage, versionId } = reference;
+    const read = await secretsManager.getSecretValue({
+        input: {
+            SecretId: secretId,
+            VersionStage: versionStage,
+            VersionId: versionId,
+        },
+    }, callerOptions);
+    const secretString = read.SecretString;
+    if (secretString === undefined) {
+        throw new SimCfnSecretsManagerReferenceProblem(`and '${secretId}' holds a binary value, which a dynamic reference ` +
+            `cannot read`);
+    }
+    if (jsonKey === undefined) {
+        return secretString;
+    }
+    return simCfnSecretsManagerJsonKeyValue(secretString, secretId, jsonKey);
+}

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.d.ts

@@ -1,16 +1,26 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -18,14 +28,20 @@ interface SimCfnSsmDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the parameter value it names.
      */
-    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution;
+    resolve(reference: SimCfnDynamicReference): SimCfnDynamicReferenceResolution | Promise<SimCfnDynamicReferenceResolution>;
     /**
      * Read the version the reference selects, or the current one.
      */
     private parameterValue;
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    private readValue;
 }
 export {};

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-dynamic-reference-resolver.js

@@ -1,14 +1,25 @@
-import { SimSsmParameterVersionNotFound } from "../../error/sim-ssm.error.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
+/** The parameter type a plain `ssm` reference leaves to `ssm-secure`. */
+const secureString = "SecureString";
 /**
  * Answers `{{resolve:ssm:...}}` references from the simulated Parameter Store.
  *
- * A reference is read as the caller deploying the Stack would read it, at the
- * point the Resource holding it is created. Real CloudFormation makes no
- * dependency out of a dynamic reference, so a parameter another Resource of
- * the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The parameter is read the way `GetParameter` reads it, as the principal the
+ * deployment names, so a caller that may not read it is denied here and the
+ * Resource fails. That is the failure a real deployment hits, where the read
+ * runs under the Stack's execution role. A deployment naming no principal
+ * reads as the Account root, which is Parameter Store's own default. Reading
+ * through the Command means waiting on it, so the answer comes back as a
+ * promise for the CloudFormation engine to wait on.
+ *
+ * A reference is read at the point the Resource holding it is created. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a
+ * parameter another Resource of the same Stack creates is only there in time
+ * if the template says `DependsOn`.
  *
  * Anything Parameter Store cannot answer becomes a stand-in value carrying a
  * reason. A template naming parameters a test never created still deploys, and
@@ -16,8 +27,10 @@ import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
  */
 export class SimCfnSsmDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the parameter value it names.
@@ -28,33 +41,35 @@ export class SimCfnSsmDynamicReferenceResolver {
             return simCfnSsmReferenceStandIn(reference, reference.body, `which is not the parameter name, optionally followed by an integer ` +
                 `version, that an ssm dynamic reference takes`);
         }
-        const { name, version } = parsed;
-        const parameter = this.ssm.findParameter(name);
-        if (parameter === undefined) {
-            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store holds no parameter '${name}'`);
-        }
-        if (parameter.type.value === "SecureString") {
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
-                `through an ssm-secure reference`);
-        }
-        return this.parameterValue(reference, parameter, name, version);
+        return this.parameterValue(reference, parsed.name, parsed.version);
     }
     /**
      * Read the version the reference selects, or the current one.
      */
-    parameterValue(reference, parameter, name, version) {
-        if (version === undefined) {
-            return { value: parameter.currentVersion.value.value };
-        }
+    async parameterValue(reference, name, version) {
+        const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            return { value: parameter.versionNumbered(Number(version)).value.value };
+            const read = await this.ssm.getParameter({ input: { Name: selector } }, this.callerOptions);
+            assertDefined(read.Parameter, `the parameter read for '${name}'`);
+            return this.readValue(reference, name, read.Parameter);
         }
         catch (error) {
-            /* v8 ignore next 3 -- defensive: only a missing version reaches here */
-            if (!(error instanceof SimSsmParameterVersionNotFound)) {
+            if (!(error instanceof SimSsmError)) {
                 throw error;
             }
-            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' has no version ${version}`);
+            return simCfnSsmReferenceStandIn(reference, name, `and simulated Parameter Store could not read it (${error.message})`);
+        }
+    }
+    /**
+     * The value the read reports, unless it is a ciphertext this reference has
+     * no business handing to a Resource.
+     */
+    readValue(reference, name, parameter) {
+        if (parameter.Type === secureString) {
+            return simCfnSsmReferenceStandIn(reference, name, `and '${name}' is a SecureString, which real CloudFormation reads ` +
+                `through an ssm-secure reference`);
         }
+        assertDefined(parameter.Value, `the value read for '${name}'`);
+        return { value: parameter.Value };
     }
 }

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.d.ts

@@ -1,18 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver, SimCfnDynamicReferenceSite } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSsm } from "../../sim-ssm.js";
 interface SimCfnSsmSecureDynamicReferenceResolverProperties {
     readonly ssm: SimSsm;
+    /** The principal the deployment runs as, which the parameter is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:ssm-secure:...}}` references from the simulated Parameter
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,6 +26,7 @@ interface SimCfnSsmSecureDynamicReferenceResolverProperties {
  */
 export declare class SimCfnSsmSecureDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly ssm;
+    private readonly callerOptions;
     constructor(properties: SimCfnSsmSecureDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the decrypted parameter value it names.

package/dist/service/ssm/cfn/dynamic/sim-cfn-ssm-secure-dynamic-reference-resolver.js

@@ -1,4 +1,5 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSsmError } from "../../error/sim-ssm.error.js";
 import { parseSimCfnSsmReferenceBody } from "./sim-cfn-ssm-reference-body.js";
 import { simCfnSsmReferenceStandIn } from "./sim-cfn-ssm-reference-stand-in.js";
@@ -8,11 +9,12 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  * Store.
  *
  * The parameter is read the way `GetParameter` with `WithDecryption` reads it,
- * as the caller deploying the Stack, so the value comes back decrypted through
- * the simulated KMS key it was written under. A caller the key does not admit
- * is denied here, which is the failure a real deployment hits. Decrypting
- * cannot be done synchronously, so the answer comes back as a promise for the
- * CloudFormation engine to wait on.
+ * as the principal the deployment names, so the value comes back decrypted
+ * through the simulated KMS key it was written under. A caller the key does
+ * not admit is denied here, which is the failure a real deployment hits. A
+ * deployment naming no principal reads as the Account root, which is Parameter
+ * Store's own default. Decrypting cannot be done synchronously, so the answer
+ * comes back as a promise for the CloudFormation engine to wait on.
  *
  * A reference the template had no business writing fails the Resource, which
  * `sim-cfn-ssm-secure-refusals.ts` holds the rules for. Everything else
@@ -22,8 +24,10 @@ import { requireSecureStringParameter, requireSsmSecureReferenceProperty, } from
  */
 export class SimCfnSsmSecureDynamicReferenceResolver {
     ssm;
+    callerOptions;
     constructor(properties) {
         this.ssm = properties.ssm;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the decrypted parameter value it names.
@@ -47,9 +51,7 @@ export class SimCfnSsmSecureDynamicReferenceResolver {
     async decrypted(reference, name, version) {
         const selector = version === undefined ? name : `${name}:${version}`;
         try {
-            const read = await this.ssm.getParameter({
-                input: { Name: selector, WithDecryption: true },
-            });
+            const read = await this.ssm.getParameter({ input: { Name: selector, WithDecryption: true } }, this.callerOptions);
             const parameter = read.Parameter;
             assertDefined(parameter, `the parameter read for '${name}'`);
             requireSecureStringParameter(name, parameter);

package/dist/service/ssm/sim-ssm.d.ts

@@ -86,12 +86,20 @@ export declare class SimSsm {
     cfnResourceFactory(): SimSsmCfnResourceFactory;
     /**
      * Get the resolver for `{{resolve:ssm:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnDynamicReferenceResolver(): SimCfnSsmDynamicReferenceResolver;
+    cfnDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmDynamicReferenceResolver;
     /**
      * Get the resolver for `{{resolve:ssm-secure:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnSecureDynamicReferenceResolver(): SimCfnSsmSecureDynamicReferenceResolver;
+    cfnSecureDynamicReferenceResolver(caller?: SimAwsCaller): SimCfnSsmSecureDynamicReferenceResolver;
     /**
      * Get the reader for `AWS::SSM::Parameter::Value<...>` template Parameters.
      */

package/dist/service/ssm/sim-ssm.js

@@ -140,15 +140,23 @@ export class SimSsm {
     }
     /**
      * Get the resolver for `{{resolve:ssm:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnDynamicReferenceResolver() {
-        return new SimCfnSsmDynamicReferenceResolver({ ssm: this });
+    cfnDynamicReferenceResolver(caller) {
+        return new SimCfnSsmDynamicReferenceResolver({ ssm: this, caller });
     }
     /**
      * Get the resolver for `{{resolve:ssm-secure:...}}` dynamic references.
+     *
+     * The caller is the principal the deployment holding the reference runs as,
+     * which the parameter is read as. Left out where the deployment named none,
+     * leaving the read as the Account root.
      */
-    cfnSecureDynamicReferenceResolver() {
-        return new SimCfnSsmSecureDynamicReferenceResolver({ ssm: this });
+    cfnSecureDynamicReferenceResolver(caller) {
+        return new SimCfnSsmSecureDynamicReferenceResolver({ ssm: this, caller });
     }
     /**
      * Get the reader for `AWS::SSM::Parameter::Value<...>` template Parameters.

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,4 +1,4 @@
-import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
@@ -14,7 +14,14 @@ interface AssumeRoleAuthorizationCoordinatorProperties {
 interface AssumeRoleAuthorizationInput {
     readonly roleArn: string;
     readonly roleArnParts: IamRoleArnParts;
-    readonly caller: SimArnPrincipal;
+    /**
+     * The caller as the request boundary resolved it.
+     *
+     * Both sides of an AssumeRole decision need the identity whose policies
+     * apply, which is the Role behind an assumed-role session. Passing the
+     * resolved caller whole is what carries it here.
+     */
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 type AssumeRoleAuthorizedRole = SimGetRoleCommandOutput["Role"];

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -38,8 +38,8 @@ export class AssumeRoleAuthorizationCoordinator {
         });
         this.sourcePrincipalAuthorizer.authorize({
             roleArn: input.roleArn,
-            callerPrincipal: input.caller,
-            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
+            caller: input.caller,
+            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller.principal, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
         });
         return targetAuthorization.role;
     }

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.d.ts

@@ -1,7 +1,7 @@
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 interface AssumeRoleSourceAccountAuthorizerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
@@ -12,7 +12,13 @@ interface AssumeRoleSourceAccountAuthorizerProperties {
 }
 export interface AssumeRoleSourceAuthorizationInput {
     readonly roleArn: string;
-    readonly callerPrincipal?: SimAwsPrincipal | undefined;
+    /**
+     * The caller as the request boundary resolved it.
+     *
+     * The identity policies deciding this are the ones held by the Role behind
+     * an assumed-role session, so the resolved caller travels here whole.
+     */
+    readonly caller?: SimAwsResolvedCaller | undefined;
     /**
      * Whether the caller must have an identity-policy Allow for sts:AssumeRole.
      *
@@ -31,8 +37,8 @@ export interface AssumeRoleSourceAuthorizationInput {
  * trust authorization is a separate responsibility and must be performed even
  * when the source and target Account are the same.
  *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
+ * When no caller principal is supplied, sim IAM applies its own default caller
+ * behaviour for the source Account.
  */
 export declare class AssumeRoleSourcePrincipalAuthorizer {
     private readonly sourceAccountId;

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.js

@@ -1,4 +1,4 @@
-import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
+import { simAwsCallerFor } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 /**
  * Authorizes the caller's request to assume a role against IAM in the source
@@ -10,8 +10,8 @@ import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
  * trust authorization is a separate responsibility and must be performed even
  * when the source and target Account are the same.
  *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
+ * When no caller principal is supplied, sim IAM applies its own default caller
+ * behaviour for the source Account.
  */
 export class AssumeRoleSourcePrincipalAuthorizer {
     sourceAccountId;
@@ -30,18 +30,19 @@ export class AssumeRoleSourcePrincipalAuthorizer {
      */
     authorize(input) {
         const sourceIam = this.iamResolver.iamForAccount(this.sourceAccountId);
-        const callerPrincipal = input.callerPrincipal ??
-            makeSimAwsAccountRootPrincipal(this.sourceAccountId);
+        // A request with no caller of its own is left for sim IAM to attribute.
+        // The simulation's default caller reaches this decision the way it reaches
+        // every other one.
         const decision = sourceIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
             region: this.regionName,
-            caller: callerPrincipal,
+            caller: input.caller === undefined ? undefined : simAwsCallerFor(input.caller),
         });
         if (decision.isExplicitDeny ||
             (decision.isImplicitDeny && Boolean(input.identityPolicyAllowRequired))) {
             throw new SimIamAccessDenied({
-                principal: callerPrincipal,
+                principal: decision.caller.principal,
                 action: "sts:AssumeRole",
                 resource: input.roleArn,
             });

package/dist/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
@@ -17,7 +17,7 @@ type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
 interface AssumeRoleTargetAuthorizationInput {
     readonly roleArn: string;
     readonly target: IamRoleArnParts | SimAwsAccountId;
-    readonly caller: SimAwsPrincipal;
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 interface AssumeRoleTargetAuthorization {

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
@@ -14,7 +14,7 @@ interface AssumeRoleTrustPolicyAuthorizationInput {
      * target Account's service control policies can be conditioned on.
      */
     readonly region?: AwsRegionName | undefined;
-    readonly caller: SimAwsPrincipal;
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 export interface AssumeRoleTrustPolicyAuthorization {
@@ -46,5 +46,9 @@ export declare class AssumeRoleTrustPolicyAuthorizer {
      * no trust-policy statement grants access, even if no explicit Deny matched.
      */
     authorize(input: AssumeRoleTrustPolicyAuthorizationInput): AssumeRoleTrustPolicyAuthorization;
+    /**
+     * Refuse the request as the caller that made it.
+     */
+    private refuse;
 }
 export {};

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -1,4 +1,5 @@
 import { jsonParse } from "../../../util/type-guard/json.js";
+import { simAwsCallerFor } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 import { AssumeRoleTrustGrantClassifier } from "./assume-role-trust-grant-classifier.js";
 /**
@@ -27,18 +28,14 @@ export class AssumeRoleTrustPolicyAuthorizer {
      */
     authorize(input) {
         if (input.role.AssumeRolePolicyDocument === undefined) {
-            throw new SimIamAccessDenied({
-                principal: input.caller,
-                action: "sts:AssumeRole",
-                resource: input.roleArn,
-            });
+            this.refuse(input);
         }
         const trustPolicy = jsonParse(input.role.AssumeRolePolicyDocument);
         const decision = input.targetIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
             region: input.region,
-            caller: input.caller,
+            caller: simAwsCallerFor(input.caller),
             conditionContext: input.conditionContext,
             resourcePolicies: [
                 {
@@ -50,15 +47,21 @@ export class AssumeRoleTrustPolicyAuthorizer {
             ],
         });
         if (decision.isDenied || !decision.isAllowedByTrustPolicy) {
-            throw new SimIamAccessDenied({
-                principal: input.caller,
-                action: "sts:AssumeRole",
-                resource: input.roleArn,
-            });
+            this.refuse(input);
         }
         return {
             decision,
             isDirectPrincipalGrant: this.trustGrantClassifier.hasDirectPrincipalGrant(decision.trustAllowStatements),
         };
     }
+    /**
+     * Refuse the request as the caller that made it.
+     */
+    refuse(input) {
+        throw new SimIamAccessDenied({
+            principal: input.caller.principal,
+            action: "sts:AssumeRole",
+            resource: input.roleArn,
+        });
+    }
 }

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -4,7 +4,7 @@ import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     /**
@@ -13,6 +13,10 @@ interface AssumeRoleCommandHandlerProperties {
     readonly regionName: AwsRegionName;
     readonly iamResolver: SimIamAccountResolver;
     readonly background?: BackgroundScheduler;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * STS AssumeRoleCommand handler.

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -16,7 +16,7 @@ import { AssumeRoleAuthorizationCoordinator } from "../../auth-z/assume-role-aut
  */
 export class AssumeRoleCommandHandler {
     background;
-    callerResolver = new SimAwsCallerResolver();
+    callerResolver;
     requestParser = new SimStsAssumeRoleRequestParser();
     authorizationCoordinator;
     sessionCreator;
@@ -25,6 +25,9 @@ export class AssumeRoleCommandHandler {
         const { sourceAccountId, regionName, iamResolver, background = new BackgroundTasks(), } = properties;
         this.sourceAccountId = sourceAccountId;
         this.background = background;
+        this.callerResolver = new SimAwsCallerResolver({
+            defaultCaller: properties.defaultCaller,
+        });
         this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
             sourceAccountId,
             iamResolver,
@@ -56,7 +59,7 @@ export class AssumeRoleCommandHandler {
         const role = await this.authorizationCoordinator.authorize({
             roleArn: request.roleArn,
             roleArnParts: request.roleArnParts,
-            caller: caller.principal,
+            caller,
             conditionContext: request.conditionContext,
         });
         return this.sessionCreator.create({

package/dist/service/sts/command/get-caller-identity/get-caller-identity.handler.d.ts

@@ -1,11 +1,15 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-account-resolver.js";
 import type { SimGetCallerIdentityCommand, SimGetCallerIdentityCommandOutput } from "./get-caller-identity.command.js";
 interface GetCallerIdentityCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Simulated STS GetCallerIdentity handler.

package/dist/service/sts/command/get-caller-identity/get-caller-identity.handler.js

@@ -13,12 +13,15 @@ import { simStsCallerUserId } from "./sim-sts-caller-user-id.js";
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/GetCallerIdentityCommand/
  */
 export class GetCallerIdentityCommandHandler {
-    callerResolver = new SimAwsCallerResolver();
+    callerResolver;
     sourceAccountId;
     iamResolver;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
         this.iamResolver = properties.iamResolver;
+        this.callerResolver = new SimAwsCallerResolver({
+            defaultCaller: properties.defaultCaller,
+        });
     }
     /**
      * Report the identity behind this request.

package/dist/service/sts/service-role/sim-service-role.js

@@ -1,3 +1,4 @@
+import { simAwsResolvedCallerOf } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 import { AssumeRoleTrustPolicyAuthorizer } from "../auth-z/assume-role-trust-policy-authorizer.js";
 import { simServiceRoleConditionContext, } from "./sim-service-role-source.js";
@@ -25,7 +26,10 @@ export async function assumeSimServiceRole(assumption) {
             role,
             targetIam: iam,
             region: scope.accountRegionScope.regionName,
-            caller: { kind: "service", service: servicePrincipal },
+            caller: simAwsResolvedCallerOf({
+                kind: "service",
+                service: servicePrincipal,
+            }),
             conditionContext: simServiceRoleConditionContext(source),
         });
     }