@kensio/yulin 1.20.15 → 1.20.16

package/README.md

@@ -22,6 +22,8 @@ npm i -D @kensio/yulin
 - [ACM](https://yulinsim.dev/services/acm/ "Simulated ACM docs")
 - [API Gateway HTTP APIs](https://yulinsim.dev/services/apigatewayv2/ "Simulated API Gateway HTTP API docs")
 - [API Gateway REST APIs](https://yulinsim.dev/services/apigateway/ "Simulated API Gateway REST API docs")
+- [Athena](https://yulinsim.dev/services/athena/ "Simulated Amazon Athena docs")
+- [Bedrock](https://yulinsim.dev/services/bedrock/ "Simulated Amazon Bedrock docs")
 - [CloudFormation](https://yulinsim.dev/services/cloudformation/ "Simulated CloudFormation docs")
 - [CloudFront](https://yulinsim.dev/services/cloudfront/ "Simulated CloudFront docs")
 - [CloudWatch metrics](https://yulinsim.dev/services/cloudwatch/ "Simulated CloudWatch metrics docs")
@@ -29,12 +31,16 @@ npm i -D @kensio/yulin
 - [DynamoDB](https://yulinsim.dev/services/dynamodb/ "Simulated DynamoDB docs")
 - [ECR](https://yulinsim.dev/services/ecr/ "Simulated ECR docs")
 - [ECS](https://yulinsim.dev/services/ecs/ "Simulated ECS docs")
+- [Elastic Load Balancing](https://yulinsim.dev/services/elbv2/ "Simulated Application Load Balancer docs")
 - [EventBridge](https://yulinsim.dev/services/eventbridge/ "Simulated EventBridge docs")
 - [Glue](https://yulinsim.dev/services/glue/ "Simulated Glue Data Catalog docs")
 - [IAM](https://yulinsim.dev/services/iam/ "Simulated IAM docs")
+- [Kinesis Data Firehose](https://yulinsim.dev/services/firehose/ "Simulated Kinesis Data Firehose docs")
+- [Kinesis Data Streams](https://yulinsim.dev/services/kinesis/ "Simulated Kinesis Data Streams docs")
 - [KMS](https://yulinsim.dev/services/kms/ "Simulated KMS docs")
 - [Lambda](https://yulinsim.dev/services/lambda/ "Simulated Lambda docs")
 - [CloudWatch Logs](https://yulinsim.dev/services/logs/ "Simulated CloudWatch Logs docs")
+- [Organizations](https://yulinsim.dev/services/organizations/ "Simulated Organizations service control policies docs")
 - [Personalize](https://yulinsim.dev/services/personalize/ "Simulated Amazon Personalize docs")
 - [Rekognition](https://yulinsim.dev/services/rekognition/ "Simulated Rekognition docs")
 - [Route53](https://yulinsim.dev/services/route53/ "Simulated Route53 docs")
@@ -54,10 +60,17 @@ npm i -D @kensio/yulin
 - [AI skill](https://yulinsim.dev/ai-skill/ "Yulin AI skill docs")
 - [The AWS CLI](https://yulinsim.dev/cli/ "The AWS CLI against simulated AWS docs")
 - [AWS SDK interception](https://yulinsim.dev/sdk/ "Simulated AWS SDK docs")
+- [Event factories](https://yulinsim.dev/factories/ "Test factories for AWS event shapes docs")
+- [Linting CloudFront Functions JS2](https://yulinsim.dev/lint/ "CloudFront Functions JS2 lint config docs")
+- [Non-AWS dependencies](https://yulinsim.dev/non-aws-dependencies/ "Dependencies Yulin does not simulate docs")
 - [Serving on localhost](https://yulinsim.dev/serve/ "Serving simulated AWS on localhost docs")
 - [Simulated time](https://yulinsim.dev/time/ "Simulated time docs")
 - [Terraform](https://yulinsim.dev/terraform/ "Deploying Terraform into simulated AWS docs")
 
+Every page listed above also ships inside the package as markdown, documenting the version
+installed. `node_modules/@kensio/yulin/llms.txt` indexes them, and a coding agent with no network
+reach can read them from there.
+
 ## Usage
 
 ### Intercept AWS SDK clients

package/dist/sdk/module/sim-sdk-module-client-interceptor.d.ts

@@ -40,6 +40,11 @@ export declare class SimSdkModuleClientInterceptor {
      *
      * Reflect.construct with the incoming new target preserves subclassing and
      * instanceof against the real class.
+     *
+     * The class's own static methods are wrapped as well, so a client built by
+     * a static factory such as `DynamoDBDocumentClient.from` is patched too.
+     * Such a factory constructs from the class binding it closes over rather
+     * than through this proxy, so the construct trap never sees it.
      */
     private wrapClientClass;
     /**

package/dist/sdk/module/sim-sdk-module-client-interceptor.js

@@ -1,4 +1,5 @@
 import { installSendPatch } from "../send-patch.js";
+import { SimSdkStaticClientFactories } from "./sim-sdk-static-client-factory.js";
 /**
  * Intercepts the SDK client classes exported by an AWS SDK package module.
  *
@@ -56,16 +57,29 @@ export class SimSdkModuleClientInterceptor {
      *
      * Reflect.construct with the incoming new target preserves subclassing and
      * instanceof against the real class.
+     *
+     * The class's own static methods are wrapped as well, so a client built by
+     * a static factory such as `DynamoDBDocumentClient.from` is patched too.
+     * Such a factory constructs from the class binding it closes over rather
+     * than through this proxy, so the construct trap never sees it.
      */
     wrapClientClass(clientClass) {
         const sendHandler = this.sendHandler;
         const configureArguments = (constructorArguments) => this.regionDefaultedArguments(constructorArguments);
+        const staticFactories = new SimSdkStaticClientFactories(sendHandler);
         return new Proxy(clientClass, {
             construct(target, constructorArguments, newTarget) {
                 const instance = Reflect.construct(target, configureArguments(constructorArguments), newTarget);
                 installSendPatch(instance, sendHandler);
                 return instance;
             },
+            get(target, property, receiver) {
+                const value = Reflect.get(target, property, receiver);
+                if (typeof value !== "function" || !Object.hasOwn(target, property)) {
+                    return value;
+                }
+                return staticFactories.wrap(value);
+            },
         });
     }
     /**

package/dist/sdk/module/sim-sdk-static-client-factory.d.ts

@@ -0,0 +1,26 @@
+import { type SimSdkSendHandler } from "../send-patch.js";
+/**
+ * The wrapped static methods of one intercepted SDK client class.
+ *
+ * A static factory such as `DynamoDBDocumentClient.from` constructs from the
+ * class binding it closes over rather than through the class the calling code
+ * holds, so the client it builds is never seen by the interception's construct
+ * trap. Wrapping the method send-patches that client on the way back out.
+ *
+ * Each method is wrapped once, so the class keeps handing out the same
+ * function for the same static.
+ */
+export declare class SimSdkStaticClientFactories {
+    private readonly sendHandler;
+    private readonly wrappers;
+    constructor(sendHandler: SimSdkSendHandler);
+    /**
+     * The patching wrapper for one static method.
+     */
+    wrap(method: object): unknown;
+    /**
+     * A Proxy rather than a plain function keeps the method's own identity
+     * surface, such as its name, length and any properties hung off it.
+     */
+    private wrapMethod;
+}

package/dist/sdk/module/sim-sdk-static-client-factory.js

@@ -0,0 +1,59 @@
+import { hasSendPatch, installSendPatch, } from "../send-patch.js";
+/**
+ * The wrapped static methods of one intercepted SDK client class.
+ *
+ * A static factory such as `DynamoDBDocumentClient.from` constructs from the
+ * class binding it closes over rather than through the class the calling code
+ * holds, so the client it builds is never seen by the interception's construct
+ * trap. Wrapping the method send-patches that client on the way back out.
+ *
+ * Each method is wrapped once, so the class keeps handing out the same
+ * function for the same static.
+ */
+export class SimSdkStaticClientFactories {
+    sendHandler;
+    wrappers = new WeakMap();
+    constructor(sendHandler) {
+        this.sendHandler = sendHandler;
+    }
+    /**
+     * The patching wrapper for one static method.
+     */
+    wrap(method) {
+        const wrapped = this.wrappers.get(method) ?? this.wrapMethod(method);
+        this.wrappers.set(method, wrapped);
+        return wrapped;
+    }
+    /**
+     * A Proxy rather than a plain function keeps the method's own identity
+     * surface, such as its name, length and any properties hung off it.
+     */
+    wrapMethod(method) {
+        const sendHandler = this.sendHandler;
+        return new Proxy(method, {
+            apply(target, thisArgument, callArguments) {
+                const result = Reflect.apply(target, thisArgument, callArguments);
+                if (isUnpatchedClient(result)) {
+                    installSendPatch(result, sendHandler);
+                }
+                return result;
+            },
+        });
+    }
+}
+/**
+ * Whether a static method's return value is a client still to be patched.
+ *
+ * A factory building through the intercepted class itself has already been
+ * patched by the construct trap, so patching again is skipped rather than
+ * rejected as a double interception.
+ */
+function isUnpatchedClient(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    if (typeof value.send !== "function") {
+        return false;
+    }
+    return !hasSendPatch(value);
+}

package/dist/sdk/send-patch.d.ts

@@ -29,3 +29,11 @@ export interface SimSdkSendPatch {
  * inherited send resolves again.
  */
 export declare function installSendPatch(target: object, handler: SimSdkSendHandler): SimSdkSendPatch;
+/**
+ * Whether a simulated send patch is currently installed on a target.
+ *
+ * Only an own patched send counts, which is the property installSendPatch
+ * writes, so an instance inheriting a patched send from a patched prototype
+ * reports false.
+ */
+export declare function hasSendPatch(target: object): boolean;

package/dist/sdk/send-patch.js

@@ -50,6 +50,17 @@ export function installSendPatch(target, handler) {
         },
     };
 }
+/**
+ * Whether a simulated send patch is currently installed on a target.
+ *
+ * Only an own patched send counts, which is the property installSendPatch
+ * writes, so an instance inheriting a patched send from a patched prototype
+ * reports false.
+ */
+export function hasSendPatch(target) {
+    const send = Object.getOwnPropertyDescriptor(target, "send")?.value;
+    return typeof send === "function" && installedSends.has(send);
+}
 /**
  * Name a patch target for diagnostics: the client's class name for instances
  * and prototypes alike, when it has one.

package/dist/service/aws/caller/sim-aws-caller-resolver.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
 import type { SimIamCredentialIdentity } from "../../iam/credential/sim-aws-credentials.js";
 export interface SimAwsCredentialIdentityResolver {
     resolveCredentials(credentials: SimCredentialCaller["credentials"], now?: Date): SimIamCredentialIdentity;
@@ -17,19 +17,41 @@ export interface SimAwsResolvedCaller {
     readonly accountId?: string | undefined;
     readonly service?: string | undefined;
 }
+/**
+ * What resolving a caller needs beyond the caller itself.
+ */
+export interface SimAwsCallerResolverProperties {
+    /**
+     * Authenticates a caller that presents credentials.
+     */
+    readonly credentialIdentityResolver?: SimAwsCredentialIdentityResolver | undefined;
+    /**
+     * The caller a request naming none of its own is attributed to.
+     *
+     * A simulation sets this to say who its unattributed calls come from. It is
+     * consulted ahead of the operation default. A simulation that names no
+     * default caller keeps the Account root fallback.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+}
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the supplied operation default. Explicit
- * anonymity is preserved. Credential callers are authenticated before a
- * resolved caller is returned, and a caller already resolved elsewhere is
- * taken as it stands.
+ * An omitted caller resolves to the simulation's default caller, and to the
+ * supplied operation default where there is none. Explicit anonymity is
+ * preserved. Credential callers are authenticated before a resolved caller is
+ * returned, and a caller already resolved elsewhere is taken as it stands.
  */
 export declare class SimAwsCallerResolver {
     private readonly credentialIdentityResolver?;
-    constructor(credentialIdentityResolver?: SimAwsCredentialIdentityResolver);
+    private readonly defaultCaller?;
+    constructor(properties?: SimAwsCallerResolverProperties);
     /**
      * Resolve and normalize a simulated AWS caller.
+     *
+     * The request's own caller is used where it has one. A request without one
+     * falls back to the simulation's default caller, and then to the operation
+     * default the call site supplies.
      */
     resolve(caller: SimAwsCaller | undefined, defaultPrincipal: SimAwsPrincipal): SimAwsResolvedCaller;
     private normalized;

package/dist/service/aws/caller/sim-aws-caller-resolver.js

@@ -2,29 +2,36 @@ import { assertDefined } from "../../../util/type-guard/defined.js";
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the supplied operation default. Explicit
- * anonymity is preserved. Credential callers are authenticated before a
- * resolved caller is returned, and a caller already resolved elsewhere is
- * taken as it stands.
+ * An omitted caller resolves to the simulation's default caller, and to the
+ * supplied operation default where there is none. Explicit anonymity is
+ * preserved. Credential callers are authenticated before a resolved caller is
+ * returned, and a caller already resolved elsewhere is taken as it stands.
  */
 export class SimAwsCallerResolver {
     credentialIdentityResolver;
-    constructor(credentialIdentityResolver) {
-        this.credentialIdentityResolver = credentialIdentityResolver;
+    defaultCaller;
+    constructor(properties = {}) {
+        this.credentialIdentityResolver = properties.credentialIdentityResolver;
+        this.defaultCaller = properties.defaultCaller;
     }
     /**
      * Resolve and normalize a simulated AWS caller.
+     *
+     * The request's own caller is used where it has one. A request without one
+     * falls back to the simulation's default caller, and then to the operation
+     * default the call site supplies.
      */
     resolve(caller, defaultPrincipal) {
-        if (caller?.kind === "resolved") {
-            return this.normalized(caller.principal, caller.identityPolicyPrincipal);
+        const stated = caller ?? this.defaultCaller;
+        if (stated?.kind === "resolved") {
+            return this.normalized(stated.principal, stated.identityPolicyPrincipal);
         }
-        if (caller?.kind === "credentials") {
+        if (stated?.kind === "credentials") {
             assertDefined(this.credentialIdentityResolver, "Simulated credential callers require an IAM credential resolver");
-            const identity = this.credentialIdentityResolver.resolveCredentials(caller.credentials);
+            const identity = this.credentialIdentityResolver.resolveCredentials(stated.credentials);
             return this.normalized(identity.principal, identity.identityPolicyPrincipal);
         }
-        const principal = caller ?? defaultPrincipal;
+        const principal = stated ?? defaultPrincipal;
         return this.normalized(principal, principal);
     }
     normalized(principal, identityPolicyPrincipal) {

package/dist/service/aws/caller/sim-aws-caller.d.ts

@@ -52,3 +52,12 @@ export interface SimResolvedCaller {
  * Caller accepted by simulated AWS service operations.
  */
 export type SimAwsCaller = SimAwsPrincipal | SimCredentialCaller | SimResolvedCaller;
+/**
+ * Caller a simulation attributes a request that names none of its own to.
+ *
+ * A principal, or a caller something else has already resolved. Credentials
+ * are left out because the Account that issued a key is the only thing able to
+ * authenticate it, while a default is held for a whole simulation. A key from
+ * one Account would fail wherever another Account decided the request.
+ */
+export type SimAwsDefaultCaller = SimAwsPrincipal | SimResolvedCaller;

package/dist/service/aws/caller/sim-aws-resolved-caller.d.ts

@@ -0,0 +1,19 @@
+import type { SimAwsPrincipal, SimResolvedCaller } from "./sim-aws-caller.js";
+import { type SimAwsResolvedCaller } from "./sim-aws-caller-resolver.js";
+/**
+ * State an already-resolved caller as the caller of another request.
+ *
+ * A resolver answers with a SimAwsResolvedCaller, and a service that goes on
+ * to ask IAM about the same caller has to pass one back in. Both principals
+ * travel together, so an assumed-role session keeps the Role its policies come
+ * from instead of arriving as a session ARN that owns none.
+ */
+export declare function simAwsCallerFor(caller: SimAwsResolvedCaller): SimResolvedCaller;
+/**
+ * Resolve a principal that needs nothing authenticated.
+ *
+ * A service principal, or an ARN something else has already established, is
+ * its own answer. This is the short way to the SimAwsResolvedCaller that an
+ * authorization boundary asks for.
+ */
+export declare function simAwsResolvedCallerOf(principal: SimAwsPrincipal): SimAwsResolvedCaller;

package/dist/service/aws/caller/sim-aws-resolved-caller.js

@@ -0,0 +1,26 @@
+import { SimAwsCallerResolver, } from "./sim-aws-caller-resolver.js";
+/**
+ * State an already-resolved caller as the caller of another request.
+ *
+ * A resolver answers with a SimAwsResolvedCaller, and a service that goes on
+ * to ask IAM about the same caller has to pass one back in. Both principals
+ * travel together, so an assumed-role session keeps the Role its policies come
+ * from instead of arriving as a session ARN that owns none.
+ */
+export function simAwsCallerFor(caller) {
+    return {
+        kind: "resolved",
+        principal: caller.principal,
+        identityPolicyPrincipal: caller.identityPolicyPrincipal,
+    };
+}
+/**
+ * Resolve a principal that needs nothing authenticated.
+ *
+ * A service principal, or an ARN something else has already established, is
+ * its own answer. This is the short way to the SimAwsResolvedCaller that an
+ * authorization boundary asks for.
+ */
+export function simAwsResolvedCallerOf(principal) {
+    return new SimAwsCallerResolver().resolve(principal, principal);
+}

package/dist/service/aws/factory/sim-aws-account-region-service-builder.d.ts

@@ -1,6 +1,7 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
 import { SimCloudFormation } from "../../cloudformation/index.js";
 import { SimCloudWatch } from "../../cloudwatch/index.js";
 import { SimCognitoIdentityProvider } from "../../cognito/index.js";
@@ -30,6 +31,10 @@ interface SimAwsAccountRegionServiceBuilderProperties {
     readonly lambdaUrlRegistry: SimLambdaUrlRegistry;
     readonly accountServices: SimAwsAccountServiceCache;
     readonly messageLog: SimAwsMessageLog;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Builder for simulated AWS services scoped to one Account and Region.
@@ -61,6 +66,7 @@ export declare class SimAwsAccountRegionServiceBuilder {
     private readonly lambdaUrlRegistry;
     private readonly accountServices;
     private readonly messageLog;
+    private readonly defaultCaller?;
     constructor(properties: SimAwsAccountRegionServiceBuilderProperties);
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -55,6 +55,7 @@ export class SimAwsAccountRegionServiceBuilder {
     lambdaUrlRegistry;
     accountServices;
     messageLog;
+    defaultCaller;
     constructor(properties) {
         this.simAws = properties.simAws;
         this.background = properties.background;
@@ -63,6 +64,7 @@ export class SimAwsAccountRegionServiceBuilder {
         this.lambdaUrlRegistry = properties.lambdaUrlRegistry;
         this.accountServices = properties.accountServices;
         this.messageLog = properties.messageLog;
+        this.defaultCaller = properties.defaultCaller;
     }
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */
@@ -269,6 +271,7 @@ export class SimAwsAccountRegionServiceBuilder {
             accountRegionScope: scope.accountRegionScope,
             background: this.background,
             iamResolver: this.iamRegistry,
+            defaultCaller: this.defaultCaller,
         });
     }
     /**

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -1,6 +1,7 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
 import type { SimAcmRegistry } from "../../acm/registry/sim-acm-registry.js";
 import type { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
@@ -25,6 +26,10 @@ interface SimAwsAccountServiceCacheProperties {
     readonly iamRegistry: SimIamRegistry;
     readonly accessKeyRegistry: SimIamAccessKeyRegistry;
     readonly scpResolver: SimIamServiceControlPolicyResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Account-level cache for simulated AWS service instances.
@@ -55,6 +60,7 @@ export declare class SimAwsAccountServiceCache {
     private readonly iamRegistry;
     private readonly accessKeyRegistry;
     private readonly scpResolver;
+    private readonly defaultCaller?;
     private readonly route53Registry;
     private readonly kmsRegistry;
     private readonly serviceHosts;

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -38,6 +38,7 @@ export class SimAwsAccountServiceCache {
     iamRegistry;
     accessKeyRegistry;
     scpResolver;
+    defaultCaller;
     route53Registry;
     kmsRegistry;
     serviceHosts;
@@ -57,6 +58,7 @@ export class SimAwsAccountServiceCache {
         this.cloudFrontRegistry = properties.cloudFrontRegistry;
         this.iamRegistry = properties.iamRegistry;
         this.scpResolver = properties.scpResolver;
+        this.defaultCaller = properties.defaultCaller;
         this.accessKeyRegistry = properties.accessKeyRegistry;
         this.route53Registry = properties.route53Registry;
         this.kmsRegistry = properties.kmsRegistry;
@@ -114,6 +116,9 @@ export class SimAwsAccountServiceCache {
                 // What the Account's organization allows it to do is decided outside
                 // the Account, so IAM asks simulated Organizations about it.
                 scpResolver: this.scpResolver,
+                // Who a request naming no caller comes from is decided for the
+                // whole simulation. Every Account in it applies the same default.
+                defaultCaller: this.defaultCaller,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-service-factory.d.ts

@@ -1,6 +1,7 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
 import type { SimAcm } from "../../acm/sim-acm.js";
 import type { SimApiGateway } from "../../apigateway/index.js";
 import type { SimApiGatewayV2 } from "../../apigatewayv2/index.js";
@@ -45,6 +46,10 @@ import { SimAwsMessageLog } from "../message/sim-aws-message-log.js";
 interface SimAwsServiceFactoryProperties {
     readonly simAws: SimAws;
     readonly background: BackgroundScheduler & BackgroundCompleter;
+    /**
+     * The caller this simulation attributes a call naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Factory for simulated AWS services used by one SimAws instance.

package/dist/service/aws/factory/sim-aws-service-factory.js

@@ -104,10 +104,16 @@ export class SimAwsServiceFactory {
             iamRegistry: this.iamRegistry,
             accessKeyRegistry: this.requestAuth.accessKeyRegistry,
             scpResolver: this.organizations,
+            // Simulated IAM applies this wherever a request names no caller of its
+            // own, in place of the Account root it would otherwise be decided as.
+            defaultCaller: properties.defaultCaller,
         });
         this.accountRegionServices = new SimAwsAccountRegionServiceBuilder({
             simAws: properties.simAws,
             background: properties.background,
+            // STS reports and evaluates the same default. An unattributed
+            // GetCallerIdentity answers with the principal everything else uses.
+            defaultCaller: properties.defaultCaller,
             registries: this.registries,
             iamRegistry: this.iamRegistry,
             lambdaUrlRegistry: this.lambdaUrlRegistry,

package/dist/service/aws/sim-aws-properties.d.ts

@@ -2,6 +2,7 @@ import type { BackgroundCompleter, BackgroundScheduler } from "../../util/backgr
 import type { SimClock } from "../../util/clock/sim-clock.js";
 import type { SimIamSigV4ExpectedScope } from "../iam/sigv4/sim-iam-sigv4-expected-scope.js";
 import type { SimAwsAccountId } from "./sim-aws-account.js";
+import type { SimAwsDefaultCaller } from "./caller/sim-aws-caller.js";
 import type { AwsRegionName } from "./sim-aws-region.js";
 /**
  * Everything caller resolution needs besides the request itself.
@@ -28,6 +29,20 @@ export interface SimAwsProperties {
      */
     readonly defaultAccountId?: SimAwsAccountId | string;
     readonly defaultRegionName?: AwsRegionName;
+    /**
+     * The principal this simulation attributes a call naming no caller to.
+     *
+     * Every simulated operation takes a `caller`, and one is set for a
+     * deployment through `deployTemplate` and `deployCdkOut`. This says who the
+     * calls that name none are, such as the role an operator reads the account
+     * through. An explicit caller always wins, as does the ambient caller of a
+     * `runAs` block.
+     *
+     * Left out, a call naming no caller is decided as the root principal of the
+     * Account it reaches. A service control policy denying that root then denies
+     * the call. That is the reason to name a default.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller;
     readonly background?: BackgroundScheduler & BackgroundCompleter;
     /**
      * Clock this simulation's timestamps start from, defaulting to the real

package/dist/service/aws/sim-aws.js

@@ -34,7 +34,7 @@ export class SimAws extends SimAwsServiceAccessors {
     requestAuthentication;
     constructor(properties = {}) {
         super();
-        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, background: suppliedBackground, } = properties;
+        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, defaultCaller, background: suppliedBackground, } = properties;
         const timekeeping = new SimAwsTimekeeping({
             clock,
             background: suppliedBackground,
@@ -47,6 +47,7 @@ export class SimAws extends SimAwsServiceAccessors {
         this.serviceFactory = new SimAwsServiceFactory({
             simAws: this,
             background,
+            defaultCaller,
         });
         this.iamRegistry = this.serviceFactory.iamRegistry;
         this.scopes = new SimAwsScopeRegistry({ simAws: this });

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,28 +1,51 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
-import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
+/**
+ * What building a caller context needs beyond the request's own caller.
+ */
+export interface SimIamAuthZCallerContextBuilderProperties {
+    /**
+     * The root principal of the Account deciding the request.
+     *
+     * This is both the last fallback for a request that names no caller and the
+     * principal holding the Account's intrinsic unrestricted access. The default
+     * caller stands apart from it. Naming a default says who an unattributed
+     * call comes from, and leaves the root's own access where AWS puts it.
+     */
+    readonly accountRootPrincipal: SimAwsPrincipal;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * The caller this simulation attributes an unattributed request to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+}
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the simulation's default caller,
+ * and as the Account root where the simulation named none. An explicit
+ * anonymous caller falls back to neither.
  */
 export declare class SimIamAuthZCallerContextBuilder {
     private readonly callerResolver;
-    private readonly defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
+    private readonly accountRootPrincipal;
+    private readonly accountRootArn?;
+    constructor(properties: SimIamAuthZCallerContextBuilderProperties);
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller: SimAwsCaller | undefined): SimIamAuthZCallerContext;
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     private rootPolicySources;
 }