@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/s3/command/authorize/sim-s3-bucket-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a Bucket.

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.d.ts

@@ -16,12 +16,21 @@ interface SimSchedulerAuthorizerProperties {
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
  * second is asked when the schedule fires, against the role rather than the
- * caller, which is why nothing about the target is consulted here.
+ * caller.
+ *
+ * A third question is asked here, about the same execution role. A schedule
+ * keeps the `Target.RoleArn` it is given and fires as it later, so the caller
+ * writing it needs `iam:PassRole` on that Role.
  */
 export declare class SimSchedulerAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimSchedulerAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Scheduler a schedule's execution role.
+     */
+    authorizePassRole(roleArn: string | undefined, options?: SimSchedulerRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a resource, named by its ARN.
      *

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { simSchedulerServicePrincipal } from "../../delivery/sim-scheduler-delivery.js";
 import { SimSchedulerAccessDeniedException } from "../../error/sim-scheduler.error.js";
 /**
  * The resource an action with no resource type authorizes against.
@@ -19,13 +21,29 @@ const noResource = "*";
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
  * second is asked when the schedule fires, against the role rather than the
- * caller, which is why nothing about the target is consulted here.
+ * caller.
+ *
+ * A third question is asked here, about the same execution role. A schedule
+ * keeps the `Target.RoleArn` it is given and fires as it later, so the caller
+ * writing it needs `iam:PassRole` on that Role.
  */
 export class SimSchedulerAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simSchedulerServicePrincipal,
+            denied: (denial) => new SimSchedulerAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand Scheduler a schedule's execution role.
+     */
+    authorizePassRole(roleArn, options) {
+        this.passRole.authorize(roleArn, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a resource, named by its ARN.

package/dist/service/scheduler/command/schedule/sim-scheduler-create-schedule.js

@@ -26,6 +26,7 @@ export class SimSchedulerCreateSchedule {
         const input = command.input;
         const requested = this.access.requested(input);
         this.access.authorize("scheduler:CreateSchedule", requested, options);
+        this.access.authorizePassRole(input, options);
         this.access.requireGroup(requested.groupName);
         if (this.schedules.find(requested.groupName, requested.name.value) !==
             undefined) {

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.d.ts

@@ -5,6 +5,7 @@ import type { SimSchedulerSchedule } from "../../schedule/sim-scheduler-schedule
 import type { SimSchedulerScheduleStore } from "../../schedule/sim-scheduler-schedule-store.js";
 import type { SimSchedulerAuthorizer } from "../authorize/sim-scheduler-authorizer.js";
 import type { SimSchedulerRequestOptions } from "../sim-scheduler-request-options.js";
+import type { SimSchedulerScheduleInput } from "./schedule.command.js";
 /**
  * Which schedule a request names, in which group.
  */
@@ -44,6 +45,13 @@ export declare class SimSchedulerScheduleAccess {
      * exist.
      */
     authorize(action: string, requested: SimSchedulerRequestedSchedule, options?: SimSchedulerRequestOptions): void;
+    /**
+     * Ensure the caller may hand Scheduler the execution role a request names.
+     *
+     * A schedule fires as its `Target.RoleArn` long after the request that wrote
+     * it, so writing one is a hand-over of that Role.
+     */
+    authorizePassRole(input: SimSchedulerScheduleInput, options?: SimSchedulerRequestOptions): void;
     /**
      * Ensure the group a request names is there, which AWS requires of every
      * request naming one.

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.js

@@ -34,6 +34,15 @@ export class SimSchedulerScheduleAccess {
     authorize(action, requested, options) {
         this.authorizer.authorizeResource(action, this.arnFor(requested), options);
     }
+    /**
+     * Ensure the caller may hand Scheduler the execution role a request names.
+     *
+     * A schedule fires as its `Target.RoleArn` long after the request that wrote
+     * it, so writing one is a hand-over of that Role.
+     */
+    authorizePassRole(input, options) {
+        this.authorizer.authorizePassRole(input.Target?.RoleArn, options);
+    }
     /**
      * Ensure the group a request names is there, which AWS requires of every
      * request naming one.

package/dist/service/scheduler/command/schedule/sim-scheduler-update-schedule.js

@@ -27,6 +27,7 @@ export class SimSchedulerUpdateSchedule {
         const input = command.input;
         const existing = this.access.require("scheduler:UpdateSchedule", input, options);
         const requested = this.access.requested(input);
+        this.access.authorizePassRole(input, options);
         // The creation date survives a replacement, because AWS does not consider
         // an updated schedule to be a new one.
         const schedule = this.writer.write(input, requested, existing.creationDate);

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-generated-name.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a secret whose template does not name it.
+ *
+ * Five hundred and twelve characters is long enough that a stack name and a
+ * logical ID rarely reach it, so `SimCfnGeneratedResourceName` seldom has to
+ * trim one. The case is left alone, since Secrets Manager keeps a name as it
+ * was given, and every character a stack name or a logical ID is made of is one
+ * a secret name allows.
+ *
+ * Real Secrets Manager appends six random characters of its own to a secret's
+ * ARN whatever the name is. A template reading the ARN back reads it off the
+ * Resource either way.
+ */
+export declare function simCfnSecretsManagerGeneratedName(resource: SimCfnResource): string;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-generated-name.js

@@ -0,0 +1,22 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { maximumSimSecretsManagerNameLength } from "../../secret/sim-secrets-manager-secret-name.js";
+/**
+ * The name CloudFormation gives a secret whose template does not name it.
+ *
+ * Five hundred and twelve characters is long enough that a stack name and a
+ * logical ID rarely reach it, so `SimCfnGeneratedResourceName` seldom has to
+ * trim one. The case is left alone, since Secrets Manager keeps a name as it
+ * was given, and every character a stack name or a logical ID is made of is one
+ * a secret name allows.
+ *
+ * Real Secrets Manager appends six random characters of its own to a secret's
+ * ARN whatever the name is. A template reading the ARN back reads it off the
+ * Resource either way.
+ */
+export function simCfnSecretsManagerGeneratedName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumSimSecretsManagerNameLength,
+    }).value;
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-properties.d.ts

@@ -10,8 +10,8 @@ interface SimCfnSecretsManagerSecretPropertiesProperties {
  * the secret creator needs.
  *
  * Keeping the property-shape rules here leaves the creator to do nothing but
- * call CreateSecret, and puts the one rule worth stating in a single place:
- * a template supplies a value or asks for one to be generated, never both.
+ * call CreateSecret. Which of the two value properties wins is its own
+ * decision, and lives in `simCfnSecretsManagerSecretValue`.
  */
 export declare class SimCfnSecretsManagerSecretProperties {
     private readonly resource;
@@ -22,11 +22,8 @@ export declare class SimCfnSecretsManagerSecretProperties {
     /**
      * The secret name.
      *
-     * An unnamed secret is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation prefixes the stack
-     * name and appends its own random characters, so a template relying on the
-     * exact generated name would be relying on something it cannot predict
-     * anyway.
+     * An unnamed secret is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name(): string;
     /**
@@ -43,11 +40,8 @@ export declare class SimCfnSecretsManagerSecretProperties {
     tags(): readonly SimSecretsManagerTag[] | undefined;
     /**
      * The value the secret's first version holds.
-     *
-     * Either the template supplies one or it asks for one to be generated.
      */
     secretString(): string;
     private string;
-    private propertyError;
 }
 export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-properties.js

@@ -1,12 +1,14 @@
 import { SimCfnSecretsManagerPropertyParser } from "../sim-cfn-secrets-manager-property-parser.js";
 import { SimCfnSecretsManagerGenerateSecretStringParser } from "./sim-cfn-secrets-manager-generate-secret-string-parser.js";
+import { simCfnSecretsManagerGeneratedName } from "./sim-cfn-secrets-manager-generated-name.js";
+import { simCfnSecretsManagerSecretValue } from "./sim-cfn-secrets-manager-secret-value.js";
 /**
  * Reads AWS::SecretsManager::Secret CloudFormation properties into the shape
  * the secret creator needs.
  *
  * Keeping the property-shape rules here leaves the creator to do nothing but
- * call CreateSecret, and puts the one rule worth stating in a single place:
- * a template supplies a value or asks for one to be generated, never both.
+ * call CreateSecret. Which of the two value properties wins is its own
+ * decision, and lives in `simCfnSecretsManagerSecretValue`.
  */
 export class SimCfnSecretsManagerSecretProperties {
     resource;
@@ -20,14 +22,12 @@ export class SimCfnSecretsManagerSecretProperties {
     /**
      * The secret name.
      *
-     * An unnamed secret is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation prefixes the stack
-     * name and appends its own random characters, so a template relying on the
-     * exact generated name would be relying on something it cannot predict
-     * anyway.
+     * An unnamed secret is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name() {
-        return (this.string(this.properties["Name"], "Name") ?? this.resource.logicalId);
+        return (this.string(this.properties["Name"], "Name") ??
+            simCfnSecretsManagerGeneratedName(this.resource));
     }
     /**
      * The secret Description.
@@ -49,33 +49,15 @@ export class SimCfnSecretsManagerSecretProperties {
     }
     /**
      * The value the secret's first version holds.
-     *
-     * Either the template supplies one or it asks for one to be generated.
      */
     secretString() {
-        const supplied = this.string(this.properties["SecretString"], "SecretString");
-        const generated = this.generateParser.parse(this.resource, this.properties["GenerateSecretString"]);
-        if (supplied !== undefined && generated !== undefined) {
-            throw this.propertyError("SecretString and GenerateSecretString cannot both be declared: " +
-                "a secret either holds the value the template supplies or one " +
-                "Secrets Manager generates");
-        }
-        if (supplied !== undefined) {
-            return supplied;
-        }
-        if (generated !== undefined) {
-            return generated.generate();
-        }
-        throw this.propertyError("either SecretString or GenerateSecretString is required. Real " +
-            "CloudFormation creates an empty secret when both are omitted, " +
-            "which simulated Secrets Manager does not model, so it refuses the " +
-            "Resource rather than creating a secret that has no value to read");
+        return simCfnSecretsManagerSecretValue({
+            resource: this.resource,
+            supplied: this.string(this.properties["SecretString"], "SecretString"),
+            generated: this.generateParser.parse(this.resource, this.properties["GenerateSecretString"]),
+        });
     }
     string(value, name) {
         return this.propertyParser.optionalString(this.resource, value, name);
     }
-    propertyError(reason) {
-        return new Error(`Invalid AWS::SecretsManager::Secret Resource ` +
-            `${this.resource.logicalId}: ${reason}`);
-    }
 }

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-value.d.ts

@@ -0,0 +1,17 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimSecretsManagerGeneratedSecretString } from "../../secret/generate/sim-secrets-manager-generated-secret-string.js";
+interface SimCfnSecretsManagerSecretValueProperties {
+    readonly resource: SimCfnResource;
+    readonly supplied: string | undefined;
+    readonly generated: SimSecretsManagerGeneratedSecretString | undefined;
+}
+/**
+ * The value a secret's first version holds.
+ *
+ * A template supplies a value or asks for one to be generated, never both and
+ * never neither. Real CloudFormation creates an empty secret where both are
+ * omitted, which simulated Secrets Manager has no model for, and a secret with
+ * no value to read is worse to be handed than a refusal.
+ */
+export declare function simCfnSecretsManagerSecretValue(properties: SimCfnSecretsManagerSecretValueProperties): string;
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-value.js

@@ -0,0 +1,30 @@
+/**
+ * The value a secret's first version holds.
+ *
+ * A template supplies a value or asks for one to be generated, never both and
+ * never neither. Real CloudFormation creates an empty secret where both are
+ * omitted, which simulated Secrets Manager has no model for, and a secret with
+ * no value to read is worse to be handed than a refusal.
+ */
+export function simCfnSecretsManagerSecretValue(properties) {
+    const { resource, supplied, generated } = properties;
+    if (supplied !== undefined && generated !== undefined) {
+        throw refusal(resource, "SecretString and GenerateSecretString cannot both be declared: " +
+            "a secret either holds the value the template supplies or one " +
+            "Secrets Manager generates");
+    }
+    if (supplied !== undefined) {
+        return supplied;
+    }
+    if (generated !== undefined) {
+        return generated.generate();
+    }
+    throw refusal(resource, "either SecretString or GenerateSecretString is required. Real " +
+        "CloudFormation creates an empty secret when both are omitted, " +
+        "which simulated Secrets Manager does not model, so it refuses the " +
+        "Resource rather than creating a secret that has no value to read");
+}
+function refusal(resource, reason) {
+    return new Error(`Invalid AWS::SecretsManager::Secret Resource ` +
+        `${resource.logicalId}: ${reason}`);
+}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-name.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The longest name Secrets Manager accepts for a secret.
+ *
+ * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
+ */
+export declare const maximumSimSecretsManagerNameLength = 512;
 /**
  * The name of one simulated secret, validated as real Secrets Manager does.
  *

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-name.js

@@ -1,6 +1,11 @@
 import { SimSecretsManagerInvalidParameterException } from "../error/sim-secrets-manager.error.js";
 import { secretArnSuffixPattern } from "./sim-secrets-manager-secret-arn.js";
-const maxNameLength = 512;
+/**
+ * The longest name Secrets Manager accepts for a secret.
+ *
+ * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
+ */
+export const maximumSimSecretsManagerNameLength = 512;
 const allowedCharacters = /^[\w+=./@-]+$/;
 /**
  * The name of one simulated secret, validated as real Secrets Manager does.
@@ -18,8 +23,8 @@ export class SimSecretsManagerSecretName {
         if (name === undefined || name === "") {
             throw new SimSecretsManagerInvalidParameterException("Name is required to create a secret");
         }
-        if (name.length > maxNameLength) {
-            throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' is longer than the ${String(maxNameLength)} characters Secrets Manager allows`);
+        if (name.length > maximumSimSecretsManagerNameLength) {
+            throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' is longer than the ${String(maximumSimSecretsManagerNameLength)} characters Secrets Manager allows`);
         }
         if (!allowedCharacters.test(name)) {
             throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' contains characters Secrets Manager does not allow: ` +

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a topic.

package/dist/service/sqs/command/authorize/sim-sqs-queue-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimSqsQueue } from "../../queue/sim-sqs-queue.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a queue.

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-generated-parameter-name.d.ts

@@ -0,0 +1,16 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a parameter whose template does not name it.
+ *
+ * How much room a name has depends on the Account and Region, since the ARN
+ * prefix comes out of the same allowance. There is enough of it that a stack
+ * name and a logical ID rarely reach the limit, so
+ * `SimCfnGeneratedResourceName` seldom has to trim one.
+ *
+ * The name carries no leading slash and so sits at the top of the hierarchy,
+ * where real CloudFormation puts a parameter it names itself. The case is left
+ * alone, since Parameter Store keeps a name as it was given, and every
+ * character a stack name or a logical ID is made of is one a parameter name
+ * allows.
+ */
+export declare function simCfnSsmGeneratedParameterName(resource: SimCfnResource): string;

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-generated-parameter-name.js

@@ -0,0 +1,23 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { maximumSimSsmParameterNameLength } from "../../parameter/sim-ssm-parameter-arn.js";
+/**
+ * The name CloudFormation gives a parameter whose template does not name it.
+ *
+ * How much room a name has depends on the Account and Region, since the ARN
+ * prefix comes out of the same allowance. There is enough of it that a stack
+ * name and a logical ID rarely reach the limit, so
+ * `SimCfnGeneratedResourceName` seldom has to trim one.
+ *
+ * The name carries no leading slash and so sits at the top of the hierarchy,
+ * where real CloudFormation puts a parameter it names itself. The case is left
+ * alone, since Parameter Store keeps a name as it was given, and every
+ * character a stack name or a logical ID is made of is one a parameter name
+ * allows.
+ */
+export function simCfnSsmGeneratedParameterName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumSimSsmParameterNameLength(resource.accountRegionScope),
+    }).value;
+}

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.d.ts

@@ -23,10 +23,8 @@ export declare class SimCfnSsmParameterProperties {
     /**
      * The parameter name.
      *
-     * An unnamed parameter is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation generates a name from
-     * the stack name and its own random characters, which a template could not
-     * predict anyway.
+     * An unnamed parameter is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name(): string;
     /**

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.js

@@ -1,3 +1,4 @@
+import { simCfnSsmGeneratedParameterName } from "./sim-cfn-ssm-generated-parameter-name.js";
 /**
  * Reads AWS::SSM::Parameter CloudFormation properties into the shape
  * PutParameter takes.
@@ -19,13 +20,12 @@ export class SimCfnSsmParameterProperties {
     /**
      * The parameter name.
      *
-     * An unnamed parameter is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation generates a name from
-     * the stack name and its own random characters, which a template could not
-     * predict anyway.
+     * An unnamed parameter is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name() {
-        return (this.string(this.properties["Name"], "Name") ?? this.resource.logicalId);
+        return (this.string(this.properties["Name"], "Name") ??
+            simCfnSsmGeneratedParameterName(this.resource));
     }
     /**
      * The parameter type.

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -12,10 +12,10 @@ export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
  * The service Parameter Store's KMS calls are made through, as
  * `kms:ViaService` names it.
  *
- * Supplying it is what lets a caller read a `SecureString` under the
- * `aws/ssm` managed key with no KMS permission of its own: that key's policy
- * admits the Account's principals only when the request reached KMS through
- * Systems Manager.
+ * The `aws/ssm` managed key's policy admits the Account's principals only when
+ * the request reached KMS through Systems Manager, so a request that does not
+ * supply this reaches the key at all only where the key policy names the
+ * caller.
  */
 export declare const ssmKmsViaService = "ssm";
 /**
@@ -35,6 +35,7 @@ export interface SimSsmKmsCrypto {
     }, options?: {
         caller?: SimAwsCaller | undefined;
         viaService?: string | undefined;
+        withCallerPermissions?: boolean | undefined;
     }): Promise<{
         CiphertextBlob?: Uint8Array | undefined;
         KeyId?: string | undefined;
@@ -47,6 +48,7 @@ export interface SimSsmKmsCrypto {
     }, options?: {
         caller?: SimAwsCaller | undefined;
         viaService?: string | undefined;
+        withCallerPermissions?: boolean | undefined;
     }): Promise<{
         Plaintext?: Uint8Array | undefined;
         KeyId?: string | undefined;

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js

@@ -11,9 +11,9 @@ export const ssmDefaultKeyAlias = "alias/aws/ssm";
  * The service Parameter Store's KMS calls are made through, as
  * `kms:ViaService` names it.
  *
- * Supplying it is what lets a caller read a `SecureString` under the
- * `aws/ssm` managed key with no KMS permission of its own: that key's policy
- * admits the Account's principals only when the request reached KMS through
- * Systems Manager.
+ * The `aws/ssm` managed key's policy admits the Account's principals only when
+ * the request reached KMS through Systems Manager, so a request that does not
+ * supply this reaches the key at all only where the key policy names the
+ * caller.
  */
 export const ssmKmsViaService = "ssm";

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.d.ts

@@ -7,6 +7,23 @@ import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-
  * rather than `...:parameter//myapp/prod/db-host`.
  */
 export declare function ssmParameterArnPrefix(accountRegionScope: SimAwsAccountRegionScope): string;
+/**
+ * The longest a parameter name may be, counting the ARN that precedes it.
+ *
+ * Real Parameter Store reserves the rest of the 2048 character ARN for its own
+ * use, and counts the ARN prefix towards the 1011 characters left. That is why
+ * this limit needs the Account and Region: the same name is legal in one
+ * Region and too long in another.
+ */
+export declare const maximumSsmParameterArnLength = 1011;
+/**
+ * The longest name a parameter may be given in this Account and Region.
+ *
+ * The ARN prefix comes out of the same allowance the name does, so the room
+ * left for a name depends on how long the Region's name is. A generated name
+ * is trimmed to this so that it is never one PutParameter would then refuse.
+ */
+export declare function maximumSimSsmParameterNameLength(accountRegionScope: SimAwsAccountRegionScope): number;
 interface SimSsmParameterArnProperties {
     readonly resource: string;
     readonly accountRegionScope: SimAwsAccountRegionScope;

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.js

@@ -9,6 +9,26 @@ export function ssmParameterArnPrefix(accountRegionScope) {
     const { regionName, accountId } = accountRegionScope;
     return `arn:aws:ssm:${regionName}:${accountId}:parameter/`;
 }
+/**
+ * The longest a parameter name may be, counting the ARN that precedes it.
+ *
+ * Real Parameter Store reserves the rest of the 2048 character ARN for its own
+ * use, and counts the ARN prefix towards the 1011 characters left. That is why
+ * this limit needs the Account and Region: the same name is legal in one
+ * Region and too long in another.
+ */
+export const maximumSsmParameterArnLength = 1011;
+/**
+ * The longest name a parameter may be given in this Account and Region.
+ *
+ * The ARN prefix comes out of the same allowance the name does, so the room
+ * left for a name depends on how long the Region's name is. A generated name
+ * is trimmed to this so that it is never one PutParameter would then refuse.
+ */
+export function maximumSimSsmParameterNameLength(accountRegionScope) {
+    return (maximumSsmParameterArnLength -
+        ssmParameterArnPrefix(accountRegionScope).length);
+}
 /**
  * The ARN of one simulated parameter.
  *

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -13,15 +13,20 @@ interface SimSsmParameterKmsProperties {
 /**
  * The KMS calls a SecureString parameter makes.
  *
- * The calls are made as the caller rather than as the service, which is the
- * point: under a customer managed key a standard tier write needs
- * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
- * top of the SSM permission for the parameter itself.
+ * The calls are made as the caller rather than as the service. Under a
+ * customer managed key a standard tier write needs `kms:Encrypt` on the key
+ * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
+ * for the parameter itself.
  *
- * They are also made through the service, which is why the `aws/ssm` managed
- * key needs no KMS permission at all: its policy admits the Account's
- * principals when `kms:ViaService` names Systems Manager, and Parameter Store
- * is what supplies that.
+ * They are also made through the service, which is what reaches the `aws/ssm`
+ * managed key at all. That key's policy admits the Account's principals when
+ * `kms:ViaService` names Systems Manager, and Parameter Store is what supplies
+ * it. Reaching the key is not the same as being allowed to use it, and a
+ * decrypting read says so with `withCallerPermissions`, because that policy
+ * admits whoever the request came from rather than the caller behind it. A
+ * Role holding `ssm:GetParameter` and no `kms:Decrypt` reads the ciphertext
+ * and not the value. A write under that key asks the caller for no KMS
+ * permission here, where AWS documents `kms:Encrypt` for one.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.
@@ -34,7 +39,8 @@ export declare class SimSsmParameterKms {
      */
     encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
     /**
-     * Decrypt a parameter value, which needs the same binding it was made with.
+     * Decrypt a parameter value, which needs the same binding it was made with,
+     * and the caller's own permission to use the key.
      */
     decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
     private contextFor;