@kensio/yulin 1.20.15 → 1.20.16

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -2,34 +2,43 @@ import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolv
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the simulation's default caller,
+ * and as the Account root where the simulation named none. An explicit
+ * anonymous caller falls back to neither.
  */
 export class SimIamAuthZCallerContextBuilder {
     callerResolver;
-    defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal, credentialIdentityResolver) {
-        this.defaultCallerPrincipal = defaultCallerPrincipal;
-        this.callerResolver = new SimAwsCallerResolver(credentialIdentityResolver);
+    accountRootPrincipal;
+    accountRootArn;
+    constructor(properties) {
+        const root = properties.accountRootPrincipal;
+        this.accountRootPrincipal = root;
+        this.accountRootArn = root.kind === "arn" ? root.arn : undefined;
+        this.callerResolver = new SimAwsCallerResolver({
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
+        });
     }
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller) {
-        const resolvedCaller = this.callerResolver.resolve(caller, this.defaultCallerPrincipal);
+        const resolvedCaller = this.callerResolver.resolve(caller, this.accountRootPrincipal);
         return {
             caller: resolvedCaller,
             rootPolicySources: this.rootPolicySources(resolvedCaller),
         };
     }
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     rootPolicySources(caller) {
-        const defaultCaller = this.callerResolver.resolve(this.defaultCallerPrincipal, this.defaultCallerPrincipal);
-        if (defaultCaller.arn === undefined || caller.arn !== defaultCaller.arn) {
+        if (this.accountRootArn === undefined ||
+            caller.arn !== this.accountRootArn) {
             return [];
         }
         return [

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,6 +1,6 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
@@ -85,6 +85,7 @@ interface SimIamAuthZContextBuilderProperties {
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation, for the identity side
      * of a cross-Account request.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -43,7 +43,11 @@ export class SimIamAuthZContextBuilder {
     derivedConditions = new SimIamDerivedConditions();
     scpSourceBuilder;
     constructor(properties) {
-        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder({
+            accountRootPrincipal: makeSimAwsAccountRootPrincipal(properties.accountId),
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
+        });
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
             policies: properties.policies,
             roles: properties.roles,

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -47,8 +47,18 @@ export declare class SimIamPolicyPrincipalMatcher {
      * The wildcard matches both authenticated and anonymous requests. Other AWS
      * forms require an ARN-based caller. Account delegation forms compare against
      * the account ID derived by the caller resolver.
+     *
+     * A pattern is compared against two ARNs, because an assumed-role session
+     * has two. The session ARN is the caller, and the Role behind it is the
+     * identity whose policies apply. AWS matches a policy naming either one, and
+     * recommends naming the Role. The two ARNs are the same for every caller
+     * that is not a session, so one comparison happens in that case.
      */
     private awsPatternMatches;
+    /**
+     * Whether a principal pattern names one of the caller's ARNs.
+     */
+    private arnMatches;
     /**
      * Compare a service principal pattern with the resolved caller.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -81,6 +81,12 @@ export class SimIamPolicyPrincipalMatcher {
      * The wildcard matches both authenticated and anonymous requests. Other AWS
      * forms require an ARN-based caller. Account delegation forms compare against
      * the account ID derived by the caller resolver.
+     *
+     * A pattern is compared against two ARNs, because an assumed-role session
+     * has two. The session ARN is the caller, and the Role behind it is the
+     * identity whose policies apply. AWS matches a policy naming either one, and
+     * recommends naming the Role. The two ARNs are the same for every caller
+     * that is not a session, so one comparison happens in that case.
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
@@ -94,9 +100,15 @@ export class SimIamPolicyPrincipalMatcher {
         if (delegatedAccountId !== undefined) {
             return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return SimIamPrincipalMatch.direct().when(simIamWildcardMatch(pattern, caller.arn, {
-            caseSensitive: true,
-        }));
+        return SimIamPrincipalMatch.direct().when(this.arnMatches(pattern, caller.arn) ||
+            this.arnMatches(pattern, caller.identityPolicyArn));
+    }
+    /**
+     * Whether a principal pattern names one of the caller's ARNs.
+     */
+    arnMatches(pattern, arn) {
+        return (arn !== undefined &&
+            simIamWildcardMatch(pattern, arn, { caseSensitive: true }));
     }
     /**
      * Compare a service principal pattern with the resolved caller.

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -1,7 +1,7 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
@@ -17,6 +17,12 @@ interface SimIamAccountAuthZProperties {
     readonly roles: Map<SimIamRoleName, SimIamRole>;
     readonly users: Map<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     *
+     * Left out, such a request is decided as this Account's root principal.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation.
      *
@@ -37,9 +43,10 @@ interface SimIamAccountAuthZProperties {
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the root principal of
- * the owning sim Account. An explicit anonymous caller suppresses that
- * fallback and is evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the simulation's default
+ * caller, and to the root principal of the owning sim Account where the
+ * simulation has none. An explicit anonymous caller suppresses both and is
+ * evaluated without identity policies.
  */
 export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -3,9 +3,10 @@ import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the root principal of
- * the owning sim Account. An explicit anonymous caller suppresses that
- * fallback and is evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the simulation's default
+ * caller, and to the root principal of the owning sim Account where the
+ * simulation has none. An explicit anonymous caller suppresses both and is
+ * evaluated without identity policies.
  */
 export class SimIamAccountAuthZ {
     properties;
@@ -38,6 +39,7 @@ export class SimIamAccountAuthZ {
             roles: this.properties.roles,
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
+            defaultCaller: this.properties.defaultCaller,
             iamResolver: this.properties.iamResolver,
             scpResolver: this.properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -3,7 +3,7 @@ import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
@@ -17,6 +17,7 @@ interface SimIamAuthorizerProperties {
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     readonly iamResolver?: SimIamAccountResolver | undefined;
     readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -17,6 +17,7 @@ export class SimIamAuthorizer {
             roles: properties.roles,
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -1,5 +1,6 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
 /**
  * What a test asks for when it wants a Role that may do something.
@@ -13,6 +14,14 @@ export interface SimIamRoleWithPolicyInput {
     readonly policyName: string;
     readonly actions: readonly string[];
     readonly resource: string;
+    /**
+     * The principal creating the Role.
+     *
+     * A simulation given a default caller attributes these two commands to it,
+     * and a Role being created for that caller has no policies to allow them
+     * yet. Naming the Account root here is how such a test bootstraps.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * The Role a CreateRole request answers with.

package/dist/service/iam/role/sim-iam-role-with-policy.factory.js

@@ -24,8 +24,10 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
     policyName: "ApplicationPolicy",
     actions: [],
     resource: "*",
+    caller: undefined,
 }), async (input, simAws) => {
     const simIam = simAws.iam();
+    const options = input.caller === undefined ? undefined : { caller: input.caller };
     const creation = await simIam.createRole({
         input: {
             RoleName: input.roleName,
@@ -38,7 +40,7 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 },
             }),
         },
-    });
+    }, options);
     await simIam.putRolePolicy({
         input: {
             RoleName: input.roleName,
@@ -47,6 +49,6 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 Statement: { Action: input.actions, Resource: input.resource },
             }),
         },
-    });
+    }, options);
     return creation.Role;
 });

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -1,6 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimAwsDefaultCaller } from "../aws/caller/sim-aws-caller.js";
 import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
@@ -19,6 +20,13 @@ export interface SimIamProperties {
     readonly credentialRegistry?: SimIamCredentialRegistry;
     readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
     readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     *
+     * A SimAws passes on what it was built with. Left out, such a request is
+     * decided as the Account root, which is what a standalone SimIam does.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
     /**
      * Resolves the IAM of other Accounts in the same simulation.
      *

package/dist/service/iam/sim-iam-account-parts.js

@@ -47,6 +47,7 @@ export class SimIamAccountParts {
             roles: this.roles,
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
+            defaultCaller: properties.defaultCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,4 +1,4 @@
-import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
@@ -14,7 +14,14 @@ interface AssumeRoleAuthorizationCoordinatorProperties {
 interface AssumeRoleAuthorizationInput {
     readonly roleArn: string;
     readonly roleArnParts: IamRoleArnParts;
-    readonly caller: SimArnPrincipal;
+    /**
+     * The caller as the request boundary resolved it.
+     *
+     * Both sides of an AssumeRole decision need the identity whose policies
+     * apply, which is the Role behind an assumed-role session. Passing the
+     * resolved caller whole is what carries it here.
+     */
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 type AssumeRoleAuthorizedRole = SimGetRoleCommandOutput["Role"];

package/dist/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -38,8 +38,8 @@ export class AssumeRoleAuthorizationCoordinator {
         });
         this.sourcePrincipalAuthorizer.authorize({
             roleArn: input.roleArn,
-            callerPrincipal: input.caller,
-            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
+            caller: input.caller,
+            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller.principal, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
         });
         return targetAuthorization.role;
     }

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.d.ts

@@ -1,7 +1,7 @@
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 interface AssumeRoleSourceAccountAuthorizerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
@@ -12,7 +12,13 @@ interface AssumeRoleSourceAccountAuthorizerProperties {
 }
 export interface AssumeRoleSourceAuthorizationInput {
     readonly roleArn: string;
-    readonly callerPrincipal?: SimAwsPrincipal | undefined;
+    /**
+     * The caller as the request boundary resolved it.
+     *
+     * The identity policies deciding this are the ones held by the Role behind
+     * an assumed-role session, so the resolved caller travels here whole.
+     */
+    readonly caller?: SimAwsResolvedCaller | undefined;
     /**
      * Whether the caller must have an identity-policy Allow for sts:AssumeRole.
      *
@@ -31,8 +37,8 @@ export interface AssumeRoleSourceAuthorizationInput {
  * trust authorization is a separate responsibility and must be performed even
  * when the source and target Account are the same.
  *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
+ * When no caller principal is supplied, sim IAM applies its own default caller
+ * behaviour for the source Account.
  */
 export declare class AssumeRoleSourcePrincipalAuthorizer {
     private readonly sourceAccountId;

package/dist/service/sts/auth-z/assume-role-source-account-auth-z.js

@@ -1,4 +1,4 @@
-import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
+import { simAwsCallerFor } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 /**
  * Authorizes the caller's request to assume a role against IAM in the source
@@ -10,8 +10,8 @@ import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
  * trust authorization is a separate responsibility and must be performed even
  * when the source and target Account are the same.
  *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
+ * When no caller principal is supplied, sim IAM applies its own default caller
+ * behaviour for the source Account.
  */
 export class AssumeRoleSourcePrincipalAuthorizer {
     sourceAccountId;
@@ -30,18 +30,19 @@ export class AssumeRoleSourcePrincipalAuthorizer {
      */
     authorize(input) {
         const sourceIam = this.iamResolver.iamForAccount(this.sourceAccountId);
-        const callerPrincipal = input.callerPrincipal ??
-            makeSimAwsAccountRootPrincipal(this.sourceAccountId);
+        // A request with no caller of its own is left for sim IAM to attribute.
+        // The simulation's default caller reaches this decision the way it reaches
+        // every other one.
         const decision = sourceIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
             region: this.regionName,
-            caller: callerPrincipal,
+            caller: input.caller === undefined ? undefined : simAwsCallerFor(input.caller),
         });
         if (decision.isExplicitDeny ||
             (decision.isImplicitDeny && Boolean(input.identityPolicyAllowRequired))) {
             throw new SimIamAccessDenied({
-                principal: callerPrincipal,
+                principal: decision.caller.principal,
                 action: "sts:AssumeRole",
                 resource: input.roleArn,
             });

package/dist/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
@@ -17,7 +17,7 @@ type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
 interface AssumeRoleTargetAuthorizationInput {
     readonly roleArn: string;
     readonly target: IamRoleArnParts | SimAwsAccountId;
-    readonly caller: SimAwsPrincipal;
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 interface AssumeRoleTargetAuthorization {

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.command.js";
 import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
@@ -14,7 +14,7 @@ interface AssumeRoleTrustPolicyAuthorizationInput {
      * target Account's service control policies can be conditioned on.
      */
     readonly region?: AwsRegionName | undefined;
-    readonly caller: SimAwsPrincipal;
+    readonly caller: SimAwsResolvedCaller;
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
 }
 export interface AssumeRoleTrustPolicyAuthorization {
@@ -46,5 +46,9 @@ export declare class AssumeRoleTrustPolicyAuthorizer {
      * no trust-policy statement grants access, even if no explicit Deny matched.
      */
     authorize(input: AssumeRoleTrustPolicyAuthorizationInput): AssumeRoleTrustPolicyAuthorization;
+    /**
+     * Refuse the request as the caller that made it.
+     */
+    private refuse;
 }
 export {};

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -1,4 +1,5 @@
 import { jsonParse } from "../../../util/type-guard/json.js";
+import { simAwsCallerFor } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 import { AssumeRoleTrustGrantClassifier } from "./assume-role-trust-grant-classifier.js";
 /**
@@ -27,18 +28,14 @@ export class AssumeRoleTrustPolicyAuthorizer {
      */
     authorize(input) {
         if (input.role.AssumeRolePolicyDocument === undefined) {
-            throw new SimIamAccessDenied({
-                principal: input.caller,
-                action: "sts:AssumeRole",
-                resource: input.roleArn,
-            });
+            this.refuse(input);
         }
         const trustPolicy = jsonParse(input.role.AssumeRolePolicyDocument);
         const decision = input.targetIam.authorize({
             action: "sts:AssumeRole",
             resource: input.roleArn,
             region: input.region,
-            caller: input.caller,
+            caller: simAwsCallerFor(input.caller),
             conditionContext: input.conditionContext,
             resourcePolicies: [
                 {
@@ -50,15 +47,21 @@ export class AssumeRoleTrustPolicyAuthorizer {
             ],
         });
         if (decision.isDenied || !decision.isAllowedByTrustPolicy) {
-            throw new SimIamAccessDenied({
-                principal: input.caller,
-                action: "sts:AssumeRole",
-                resource: input.roleArn,
-            });
+            this.refuse(input);
         }
         return {
             decision,
             isDirectPrincipalGrant: this.trustGrantClassifier.hasDirectPrincipalGrant(decision.trustAllowStatements),
         };
     }
+    /**
+     * Refuse the request as the caller that made it.
+     */
+    refuse(input) {
+        throw new SimIamAccessDenied({
+            principal: input.caller.principal,
+            action: "sts:AssumeRole",
+            resource: input.roleArn,
+        });
+    }
 }

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -4,7 +4,7 @@ import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface AssumeRoleCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     /**
@@ -13,6 +13,10 @@ interface AssumeRoleCommandHandlerProperties {
     readonly regionName: AwsRegionName;
     readonly iamResolver: SimIamAccountResolver;
     readonly background?: BackgroundScheduler;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * STS AssumeRoleCommand handler.

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -16,7 +16,7 @@ import { AssumeRoleAuthorizationCoordinator } from "../../auth-z/assume-role-aut
  */
 export class AssumeRoleCommandHandler {
     background;
-    callerResolver = new SimAwsCallerResolver();
+    callerResolver;
     requestParser = new SimStsAssumeRoleRequestParser();
     authorizationCoordinator;
     sessionCreator;
@@ -25,6 +25,9 @@ export class AssumeRoleCommandHandler {
         const { sourceAccountId, regionName, iamResolver, background = new BackgroundTasks(), } = properties;
         this.sourceAccountId = sourceAccountId;
         this.background = background;
+        this.callerResolver = new SimAwsCallerResolver({
+            defaultCaller: properties.defaultCaller,
+        });
         this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
             sourceAccountId,
             iamResolver,
@@ -56,7 +59,7 @@ export class AssumeRoleCommandHandler {
         const role = await this.authorizationCoordinator.authorize({
             roleArn: request.roleArn,
             roleArnParts: request.roleArnParts,
-            caller: caller.principal,
+            caller,
             conditionContext: request.conditionContext,
         });
         return this.sessionCreator.create({

package/dist/service/sts/command/get-caller-identity/get-caller-identity.handler.d.ts

@@ -1,11 +1,15 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-account-resolver.js";
 import type { SimGetCallerIdentityCommand, SimGetCallerIdentityCommandOutput } from "./get-caller-identity.command.js";
 interface GetCallerIdentityCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     readonly iamResolver: SimIamAccountResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Simulated STS GetCallerIdentity handler.

package/dist/service/sts/command/get-caller-identity/get-caller-identity.handler.js

@@ -13,12 +13,15 @@ import { simStsCallerUserId } from "./sim-sts-caller-user-id.js";
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/GetCallerIdentityCommand/
  */
 export class GetCallerIdentityCommandHandler {
-    callerResolver = new SimAwsCallerResolver();
+    callerResolver;
     sourceAccountId;
     iamResolver;
     constructor(properties) {
         this.sourceAccountId = properties.sourceAccountId;
         this.iamResolver = properties.iamResolver;
+        this.callerResolver = new SimAwsCallerResolver({
+            defaultCaller: properties.defaultCaller,
+        });
     }
     /**
      * Report the identity behind this request.

package/dist/service/sts/service-role/sim-service-role.js

@@ -1,3 +1,4 @@
+import { simAwsResolvedCallerOf } from "../../aws/caller/sim-aws-resolved-caller.js";
 import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
 import { AssumeRoleTrustPolicyAuthorizer } from "../auth-z/assume-role-trust-policy-authorizer.js";
 import { simServiceRoleConditionContext, } from "./sim-service-role-source.js";
@@ -25,7 +26,10 @@ export async function assumeSimServiceRole(assumption) {
             role,
             targetIam: iam,
             region: scope.accountRegionScope.regionName,
-            caller: { kind: "service", service: servicePrincipal },
+            caller: simAwsResolvedCallerOf({
+                kind: "service",
+                service: servicePrincipal,
+            }),
             conditionContext: simServiceRoleConditionContext(source),
         });
     }