@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -1,5 +1,6 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
 /**
  * What a test asks for when it wants a Role that may do something.
@@ -13,6 +14,16 @@ export interface SimIamRoleWithPolicyInput {
     readonly policyName: string;
     readonly actions: readonly string[];
     readonly resource: string;
+    /**
+     * The principal creating the Role.
+     *
+     * A simulation given a default caller attributes these two commands to it,
+     * and a Role being created for that caller has no policies to allow them
+     * yet. Naming the Account root here is one way for such a test to bootstrap.
+     * Calling inside `simAws.runAs(simAws.account().rootPrincipal, ...)` is the
+     * other, and covers everything else the block does as well.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * The Role a CreateRole request answers with.

package/dist/service/iam/role/sim-iam-role-with-policy.factory.js

@@ -24,8 +24,10 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
     policyName: "ApplicationPolicy",
     actions: [],
     resource: "*",
+    caller: undefined,
 }), async (input, simAws) => {
     const simIam = simAws.iam();
+    const options = input.caller === undefined ? undefined : { caller: input.caller };
     const creation = await simIam.createRole({
         input: {
             RoleName: input.roleName,
@@ -38,7 +40,7 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 },
             }),
         },
-    });
+    }, options);
     await simIam.putRolePolicy({
         input: {
             RoleName: input.roleName,
@@ -47,6 +49,6 @@ export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
                 Statement: { Action: input.actions, Resource: input.resource },
             }),
         },
-    });
+    }, options);
     return creation.Role;
 });

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -1,6 +1,8 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimAwsDefaultCaller } from "../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../aws/caller/sim-aws-ambient-caller.js";
 import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
@@ -19,6 +21,20 @@ export interface SimIamProperties {
     readonly credentialRegistry?: SimIamCredentialRegistry;
     readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
     readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     *
+     * A SimAws passes on what it was built with. Left out, such a request is
+     * decided as the Account root, which is what a standalone SimIam does.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A SimAws passes on the run-as block it is inside, if any. A standalone
+     * SimIam has no run-as around it and leaves this out.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves the IAM of other Accounts in the same simulation.
      *

package/dist/service/iam/sim-iam-account-parts.js

@@ -47,6 +47,8 @@ export class SimIamAccountParts {
             roles: this.roles,
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
+            defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/sim-iam.d.ts

@@ -3,7 +3,7 @@ import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
-import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-input.js";
 import type { SimIamPolicyDecision } from "./authorize/sim-iam-decision.js";
 import type * as simIamCommands from "./command/sim-iam-command.types.js";
 import type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
@@ -11,11 +11,12 @@ import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/fa
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import type { SimIamAccountIdentityPolicies } from "./authorize/identity/sim-iam-account-identity-policies.js";
 import type { SimIamAuthZPolicySource } from "./authorize/context/sim-iam-auth-z-context.js";
-import type { SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
+import type { SimArnPrincipal, SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
 import type { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
 import { type SimIamProperties } from "./sim-iam-account-parts.js";
+import { type SimIamDeployRoleInput } from "./role/sim-iam-deploy-role.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -52,6 +53,7 @@ export declare class SimIam implements SimIamInterServiceAuthZ, SimIamAccountIde
     private readonly commands;
     private readonly accountAuthZ;
     private readonly sdkRouter;
+    private readonly deployRoles;
     constructor(properties?: SimIamProperties);
     /**
      * Evaluate an IAM authorization attempt against policies relevant to the
@@ -140,6 +142,14 @@ export declare class SimIam implements SimIamInterServiceAuthZ, SimIamAccountIde
      * Handle an IAM CreateAccessKey command.
      */
     createAccessKey(command: simIamCommands.SimCreateAccessKeyCommand, options?: SimIamRequestOptions): Promise<simIamCommands.SimCreateAccessKeyCommandOutput>;
+    /**
+     * Make a Role for a CloudFormation deployment to run as.
+     *
+     * The Role is trusted by `cloudformation.amazonaws.com` and allowed what the
+     * policy documents allow. What comes back goes straight to `caller` on
+     * `deployTemplate`, `deployTemplateFile` or `deployCdkOut`.
+     */
+    makeDeployRole(input: SimIamDeployRoleInput): Promise<SimArnPrincipal>;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/iam/sim-iam.js

@@ -1,6 +1,7 @@
 import { SimIamCloudFormationResourceFactory } from "./cfn/sim-cfn-iam-resource-factory.js";
 import { SimIamSdkCommandRouter } from "./sdk/sim-iam-sdk-command-router.js";
 import { SimIamAccountParts, } from "./sim-iam-account-parts.js";
+import { SimIamDeployRoleMaker, } from "./role/sim-iam-deploy-role.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -37,6 +38,7 @@ export class SimIam {
     commands;
     accountAuthZ;
     sdkRouter = new SimIamSdkCommandRouter(this);
+    deployRoles = new SimIamDeployRoleMaker(this);
     constructor(properties = {}) {
         const parts = new SimIamAccountParts(properties);
         this.accountId = parts.accountId;
@@ -176,6 +178,16 @@ export class SimIam {
     async createAccessKey(command, options) {
         return await this.commands.users.createAccessKey(command, options);
     }
+    /**
+     * Make a Role for a CloudFormation deployment to run as.
+     *
+     * The Role is trusted by `cloudformation.amazonaws.com` and allowed what the
+     * policy documents allow. What comes back goes straight to `caller` on
+     * `deployTemplate`, `deployTemplateFile` or `deployCdkOut`.
+     */
+    async makeDeployRole(input) {
+        return await this.deployRoles.make(input);
+    }
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/iam/validate/size/sim-iam-policy-document-size.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The longest managed policy document IAM will take.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+export declare const maxSimIamManagedPolicyCharacters = 6144;
+/**
+ * The longest inline policy document IAM will take on a Role or a User.
+ */
+export declare const maxSimIamInlinePolicyCharacters = 10240;
+/**
+ * The longest trust policy document IAM will take on a Role.
+ *
+ * This one is adjustable, up to 8,192 characters. A simulation holds the
+ * default an account carries until it asks for more.
+ */
+export declare const maxSimIamTrustPolicyCharacters = 2048;
+/**
+ * The Role or the User an inline policy is being put onto.
+ */
+export interface SimIamPolicyDocumentHolder {
+    /**
+     * What IAM calls the holder in the message, `role` or `user`.
+     */
+    readonly kind: "role" | "user";
+    /**
+     * The holder's name.
+     */
+    readonly name: string;
+}
+/**
+ * Measure a policy document the way IAM does, which leaves whitespace out.
+ *
+ * A document indented for a reader therefore counts the same as the one line
+ * `JSON.stringify` produces, and a template can be written either way.
+ */
+export declare function simIamPolicyDocumentSize(policyDocument: string): number;
+/**
+ * Refuse a managed policy document over the character limit.
+ *
+ * A policy past the limit cannot be deployed, and the account keeps whichever
+ * version last fit. The permission the document was grown to grant then goes
+ * missing weeks later, at a distance from the change that lost it. Refusing
+ * the document here puts the fault beside the policy that carries it.
+ *
+ * The requiredness check refuses an absent document. This one has nothing to
+ * measure.
+ */
+export declare function assertSimIamManagedPolicyWithinSizeLimit(policyDocument: string | undefined): void;
+/**
+ * Refuse an inline policy document over the character limit.
+ */
+export declare function assertSimIamInlinePolicyWithinSizeLimit(policyDocument: string | undefined, holder: SimIamPolicyDocumentHolder): void;
+/**
+ * Refuse a Role trust policy document over the character limit.
+ */
+export declare function assertSimIamTrustPolicyWithinSizeLimit(policyDocument: string | undefined, roleName: string): void;

package/dist/service/iam/validate/size/sim-iam-policy-document-size.js

@@ -0,0 +1,71 @@
+import { SimIamLimitExceeded } from "../../error/sim-iam.error.js";
+/**
+ * The longest managed policy document IAM will take.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+export const maxSimIamManagedPolicyCharacters = 6144;
+/**
+ * The longest inline policy document IAM will take on a Role or a User.
+ */
+export const maxSimIamInlinePolicyCharacters = 10_240;
+/**
+ * The longest trust policy document IAM will take on a Role.
+ *
+ * This one is adjustable, up to 8,192 characters. A simulation holds the
+ * default an account carries until it asks for more.
+ */
+export const maxSimIamTrustPolicyCharacters = 2048;
+/**
+ * Measure a policy document the way IAM does, which leaves whitespace out.
+ *
+ * A document indented for a reader therefore counts the same as the one line
+ * `JSON.stringify` produces, and a template can be written either way.
+ */
+export function simIamPolicyDocumentSize(policyDocument) {
+    return policyDocument.replaceAll(/\s/gu, "").length;
+}
+/**
+ * Refuse a managed policy document over the character limit.
+ *
+ * A policy past the limit cannot be deployed, and the account keeps whichever
+ * version last fit. The permission the document was grown to grant then goes
+ * missing weeks later, at a distance from the change that lost it. Refusing
+ * the document here puts the fault beside the policy that carries it.
+ *
+ * The requiredness check refuses an absent document. This one has nothing to
+ * measure.
+ */
+export function assertSimIamManagedPolicyWithinSizeLimit(policyDocument) {
+    if (policyDocument === undefined ||
+        simIamPolicyDocumentSize(policyDocument) <= maxSimIamManagedPolicyCharacters) {
+        return;
+    }
+    throw new SimIamLimitExceeded(`Cannot exceed quota for PolicySize: ${String(maxSimIamManagedPolicyCharacters)}`);
+}
+/**
+ * Refuse an inline policy document over the character limit.
+ */
+export function assertSimIamInlinePolicyWithinSizeLimit(policyDocument, holder) {
+    assertWithinMaximumPolicySize(policyDocument, maxSimIamInlinePolicyCharacters, holder);
+}
+/**
+ * Refuse a Role trust policy document over the character limit.
+ */
+export function assertSimIamTrustPolicyWithinSizeLimit(policyDocument, roleName) {
+    assertWithinMaximumPolicySize(policyDocument, maxSimIamTrustPolicyCharacters, { kind: "role", name: roleName });
+}
+/**
+ * IAM reports both of these in bytes, over a count that is really characters
+ * with the whitespace taken out. The wording is kept as IAM writes it. A
+ * reader searching for the message finds what a real deploy would have told
+ * them.
+ */
+function assertWithinMaximumPolicySize(policyDocument, maxCharacters, holder) {
+    if (policyDocument === undefined ||
+        simIamPolicyDocumentSize(policyDocument) <= maxCharacters) {
+        return;
+    }
+    throw new SimIamLimitExceeded(`Maximum policy size of ${String(maxCharacters)} bytes exceeded for ` +
+        `${holder.kind} ${holder.name}`);
+}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -20,7 +20,9 @@ interface SimKmsAuthorizerProperties {
  * Both carry the KMS condition values a key policy can be written against:
  * `kms:CallerAccount` for the Account the request came from, and
  * `kms:ViaService` where another service made the request on the caller's
- * behalf.
+ * behalf. A service passing on the caller's own KMS permissions says so, and
+ * a key policy admitting whoever the request came from is then not enough by
+ * itself.
  */
 export declare class SimKmsAuthorizer {
     private readonly iam;

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -15,7 +15,9 @@ import { SimKmsViaService } from "../../key/sim-kms-via-service.js";
  * Both carry the KMS condition values a key policy can be written against:
  * `kms:CallerAccount` for the Account the request came from, and
  * `kms:ViaService` where another service made the request on the caller's
- * behalf.
+ * behalf. A service passing on the caller's own KMS permissions says so, and
+ * a key policy admitting whoever the request came from is then not enough by
+ * itself.
  */
 export class SimKmsAuthorizer {
     iam;
@@ -41,6 +43,7 @@ export class SimKmsAuthorizer {
             callerConditions: this.callerAccount,
             resourcePolicies: [key.policy.asResourcePolicy()],
             requiresResourcePolicyAllow: true,
+            withCallerPermissions: options.withCallerPermissions,
         });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({

package/dist/service/kms/command/sim-kms-request-options.d.ts

@@ -20,4 +20,15 @@ export interface SimKmsRequestOptions {
      * and a policy conditioned on `kms:ViaService` then does not match.
      */
     readonly viaService?: string | undefined;
+    /**
+     * Whether the service named by `viaService` is making the request with the
+     * caller's own KMS permissions rather than with its own.
+     *
+     * Parameter Store decrypts a SecureString this way. A caller holding
+     * ssm:GetParameter and no kms:Decrypt is refused even under the aws/ssm key,
+     * whose policy admits the Account's principals reaching KMS through Systems
+     * Manager. A key policy naming the caller still allows the request on its
+     * own, as it does for any other KMS request.
+     */
+    readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/kms/key/sim-kms-key-policy.d.ts

@@ -1,5 +1,5 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
 import { type SimKmsViaService } from "./sim-kms-via-service.js";
 /**
@@ -38,9 +38,10 @@ export declare class SimKmsKeyPolicy {
      * through the service that owns the key, and it delegates nothing else to
      * IAM: the second statement covers reading the key's metadata and no more.
      *
-     * That is what makes an AWS managed key usable by a caller holding no KMS
-     * permission at all, and unusable by a caller holding kms:Decrypt on it who
-     * calls KMS directly.
+     * That is what makes an AWS managed key unusable by a caller holding
+     * kms:Decrypt on it who calls KMS directly. What the first statement admits
+     * is whoever reached KMS through the owning service, which allows the
+     * request on its own only where that service used its own permissions.
      */
     static awsManaged(keyArn: string, accountId: SimAwsAccountId, viaService: SimKmsViaService): SimKmsKeyPolicy;
     /**

package/dist/service/kms/key/sim-kms-key-policy.js

@@ -53,9 +53,10 @@ export class SimKmsKeyPolicy {
      * through the service that owns the key, and it delegates nothing else to
      * IAM: the second statement covers reading the key's metadata and no more.
      *
-     * That is what makes an AWS managed key usable by a caller holding no KMS
-     * permission at all, and unusable by a caller holding kms:Decrypt on it who
-     * calls KMS directly.
+     * That is what makes an AWS managed key unusable by a caller holding
+     * kms:Decrypt on it who calls KMS directly. What the first statement admits
+     * is whoever reached KMS through the owning service, which allows the
+     * request on its own only where that service used its own permissions.
      */
     static awsManaged(keyArn, accountId, viaService) {
         return new SimKmsKeyPolicy(keyArn, {

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.d.ts

@@ -48,8 +48,8 @@ export declare class SimCfnLambdaFunctionPropertiesParser {
      */
     private roleArn;
     /**
-     * The function name defaults to the logical ID, as CloudFormation
-     * effectively names unnamed functions from it.
+     * An unnamed function gets the name CloudFormation generates for it, from
+     * the stack name and the logical ID.
      */
     private functionName;
 }

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.js

@@ -3,6 +3,7 @@ import { SimCfnLambdaDeadLetterParser } from "./sim-cfn-lambda-dead-letter-parse
 import { SimCfnLambdaEnvironmentParser } from "./sim-cfn-lambda-environment-parser.js";
 import { SimCfnLambdaFunctionCodeParser } from "./sim-cfn-lambda-function-code-parser.js";
 import { SimCfnLambdaPropertyParser } from "./sim-cfn-lambda-property-parser.js";
+import { simCfnLambdaGeneratedFunctionName } from "./sim-cfn-lambda-generated-function-name.js";
 /**
  * Map parsed AWS::Lambda::Function properties onto the sim Lambda
  * CreateFunction command input, with the code input resolved separately so
@@ -74,10 +75,10 @@ export class SimCfnLambdaFunctionPropertiesParser {
         });
     }
     /**
-     * The function name defaults to the logical ID, as CloudFormation
-     * effectively names unnamed functions from it.
+     * An unnamed function gets the name CloudFormation generates for it, from
+     * the stack name and the logical ID.
      */
     functionName(resource, properties) {
-        return (this.propertyParser.optionalString(resource, properties["FunctionName"], "FunctionName") ?? resource.logicalId);
+        return (this.propertyParser.optionalString(resource, properties["FunctionName"], "FunctionName") ?? simCfnLambdaGeneratedFunctionName(resource));
     }
 }

package/dist/service/lambda/cfn/function/sim-cfn-lambda-generated-function-name.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a function whose template does not name it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since Lambda keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one a function name allows.
+ */
+export declare function simCfnLambdaGeneratedFunctionName(resource: SimCfnResource): string;

package/dist/service/lambda/cfn/function/sim-cfn-lambda-generated-function-name.js

@@ -0,0 +1,25 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+/**
+ * The longest name Lambda accepts for a function.
+ *
+ * The 140 characters `CreateFunction` documents are for a full ARN. A bare
+ * function name gets 64, and that is what a template generates.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html
+ */
+const maximumNameLength = 64;
+/**
+ * The name CloudFormation gives a function whose template does not name it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since Lambda keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one a function name allows.
+ */
+export function simCfnLambdaGeneratedFunctionName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value;
+}

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimLambdaPolicyResource } from "../../function/policy/sim-lambda-policy-resource.js";
 /**
  * The resource policies IAM should evaluate alongside identity policies for an

package/dist/service/lambda/command/create-function/create-function-authorizer.d.ts

@@ -8,18 +8,25 @@ interface CreateFunctionAuthorizerProperties {
  *
  * AWS maps the CreateFunction API operation to the lambda:CreateFunction IAM
  * action. The resource is the function ARN being created.
+ *
+ * The execution role is a second question. Lambda keeps that Role and runs the
+ * function as it later, so the caller is asked whether they may hand it over,
+ * against the Role rather than the function. The create action is decided
+ * first, which is the order the two answers come in on real AWS.
  */
 export declare class CreateFunctionAuthorizer {
     private static readonly action;
     private readonly iam;
+    private readonly passRole;
     constructor(properties: CreateFunctionAuthorizerProperties);
     /**
-     * Ensure the caller may create a Lambda function with the given ARN.
+     * Ensure the caller may create a Lambda function with the given ARN, and may
+     * hand Lambda the execution role it names.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn: string, caller?: SimAwsCaller): void;
+    authorize(functionArn: string, roleArn: string, caller?: SimAwsCaller): void;
 }
 export {};

package/dist/service/lambda/command/create-function/create-function-authorizer.js

@@ -1,24 +1,37 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simLambdaServicePrincipal } from "../../sim-lambda-service-principal.js";
 /**
  * Applies IAM authorization to a Lambda CreateFunction request.
  *
  * AWS maps the CreateFunction API operation to the lambda:CreateFunction IAM
  * action. The resource is the function ARN being created.
+ *
+ * The execution role is a second question. Lambda keeps that Role and runs the
+ * function as it later, so the caller is asked whether they may hand it over,
+ * against the Role rather than the function. The create action is decided
+ * first, which is the order the two answers come in on real AWS.
  */
 export class CreateFunctionAuthorizer {
     static action = "lambda:CreateFunction";
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simLambdaServicePrincipal,
+        });
     }
     /**
-     * Ensure the caller may create a Lambda function with the given ARN.
+     * Ensure the caller may create a Lambda function with the given ARN, and may
+     * hand Lambda the execution role it names.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn, caller) {
+    authorize(functionArn, roleArn, caller) {
         const decision = this.iam.authorize({
             action: CreateFunctionAuthorizer.action,
             resource: functionArn,
@@ -32,5 +45,6 @@ export class CreateFunctionAuthorizer {
                 resource: functionArn,
             });
         }
+        this.passRole.authorize(roleArn, caller);
     }
 }

package/dist/service/lambda/command/create-function/create-function.handler.js

@@ -51,7 +51,7 @@ export class CreateFunctionCommandHandler {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const functionArn = simLambdaFunctionArn(this.accountRegionScope, input.name);
-        this.authorizer.authorize(functionArn, options?.caller);
+        this.authorizer.authorize(functionArn, input.roleArn, options?.caller);
         this.requireAvailableFunctionName(input.name, functionArn);
         const environment = this.makeEnvironment(input);
         const code = await this.resolveCode(input, environment, options?.caller);

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.d.ts

@@ -9,19 +9,24 @@ interface UpdateFunctionConfigurationAuthorizerProperties {
  * AWS maps the UpdateFunctionConfiguration API operation to the
  * lambda:UpdateFunctionConfiguration IAM action. The resource is the ARN of
  * the function whose settings are changing.
+ *
+ * A request changing the execution role hands Lambda a Role, and is asked
+ * separately whether it may pass that one. A request leaving the role alone
+ * passes nothing and is asked nothing.
  */
 export declare class UpdateFunctionConfigurationAuthorizer {
     private static readonly action;
     private readonly iam;
+    private readonly passRole;
     constructor(properties: UpdateFunctionConfigurationAuthorizerProperties);
     /**
      * Ensure the caller may change the settings of the function with the given
-     * ARN.
+     * ARN, and may hand Lambda an execution role the request replaces it with.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn: string, caller?: SimAwsCaller): void;
+    authorize(functionArn: string, roleArn: string | undefined, caller?: SimAwsCaller): void;
 }
 export {};

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.js

@@ -1,26 +1,37 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simLambdaServicePrincipal } from "../../sim-lambda-service-principal.js";
 /**
  * Applies IAM authorization to a Lambda UpdateFunctionConfiguration request.
  *
  * AWS maps the UpdateFunctionConfiguration API operation to the
  * lambda:UpdateFunctionConfiguration IAM action. The resource is the ARN of
  * the function whose settings are changing.
+ *
+ * A request changing the execution role hands Lambda a Role, and is asked
+ * separately whether it may pass that one. A request leaving the role alone
+ * passes nothing and is asked nothing.
  */
 export class UpdateFunctionConfigurationAuthorizer {
     static action = "lambda:UpdateFunctionConfiguration";
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simLambdaServicePrincipal,
+        });
     }
     /**
      * Ensure the caller may change the settings of the function with the given
-     * ARN.
+     * ARN, and may hand Lambda an execution role the request replaces it with.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn, caller) {
+    authorize(functionArn, roleArn, caller) {
         const decision = this.iam.authorize({
             action: UpdateFunctionConfigurationAuthorizer.action,
             resource: functionArn,
@@ -34,5 +45,6 @@ export class UpdateFunctionConfigurationAuthorizer {
                 resource: functionArn,
             });
         }
+        this.passRole.authorize(roleArn, caller);
     }
 }

package/dist/service/lambda/command/update-function-configuration/update-function-configuration.handler.js

@@ -36,7 +36,7 @@ export class UpdateFunctionConfigurationCommandHandler {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const functionName = simLambdaUnqualifiedFunctionOf(name);
-        this.authorizer.authorize(this.functions.functionArn(functionName), options?.caller);
+        this.authorizer.authorize(this.functions.functionArn(functionName), update.roleArn, options?.caller);
         const simFunction = this.functions.require(functionName);
         simFunction.updateConfiguration(update);
         if (update.environmentVariables !== undefined) {