@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/cloudfront/sim-cloudfront.js

@@ -1,6 +1,6 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimCloudFrontCloudFormationResourceFactory } from "./cfn/sim-cfn-cloudfront-resource-factory.js";
-import { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
+import { SimCloudFrontPolicies } from "./sim-cloudfront-policies.js";
 import { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
 import { simCffNameInArn } from "./cff/sim-cff-arn.js";
 import { SimCloudFrontSdkCommandRouter } from "./sdk/sim-cloudfront-sdk-command-router.js";
@@ -8,16 +8,16 @@ import { SimCloudFrontCommands, } from "./sim-cloudfront-commands.js";
 /**
  * Simulated CloudFront. Handles SDK commands. Emulates AWS behaviour and state.
  */
-export class SimCloudFront {
+export class SimCloudFront extends SimCloudFrontPolicies {
     distributions = new Map();
     cloudFrontFunctions = new Map();
-    responseHeadersPolicies = new SimCloudFrontResponseHeadersPolicyRegistry();
     originAccessControls = new SimCloudFrontOriginAccessControlRegistry();
     accountRegionScope;
     commands;
     cfnFactory = new SimCloudFrontCloudFormationResourceFactory(this);
     sdkRouter = new SimCloudFrontSdkCommandRouter(this);
     constructor(properties = {}) {
+        super();
         this.accountRegionScope =
             properties.accountRegionScope ?? simAwsAccountRegionScopeFactory.make();
         this.commands = new SimCloudFrontCommands({
@@ -27,6 +27,7 @@ export class SimCloudFront {
             cloudFrontFunctions: this.cloudFrontFunctions,
             originAccessControls: this.originAccessControls,
             responseHeadersPolicies: this.responseHeadersPolicies,
+            cachePolicies: this.cachePolicies,
         });
     }
     /**
@@ -84,48 +85,44 @@ export class SimCloudFront {
      * Handle a Create Function Command from the SDK.
      */
     async createFunction(command, options) {
-        return await this.commands.createFunction(command, options);
+        return await this.commands.functions.createFunction(command, options);
     }
     /**
      * Handle a Delete Function Command from the SDK.
      */
     async deleteFunction(command, options) {
-        return await this.commands.deleteFunction(command, options);
+        return await this.commands.functions.deleteFunction(command, options);
     }
     /**
-     * Get a sim CloudFront Function by ARN.
+     * Handle a List Functions Command from the SDK.
      */
-    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
-        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
-        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
+    async listFunctions(command, options) {
+        return await this.commands.functions.listFunctions(command, options);
     }
     /**
-     * Get a sim CloudFront Function by name.
+     * Handle a Describe Function Command from the SDK.
      */
-    getCloudFrontFunctionByName(cloudFrontFunctionName) {
-        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
+    async describeFunction(command, options) {
+        return await this.commands.functions.describeFunction(command, options);
     }
     /**
-     * Store a simulated response headers policy.
-     *
-     * There is no CreateResponseHeadersPolicy command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands the policy over.
-     * A name another policy already holds is refused, as CloudFront refuses one.
+     * Handle a Get Function Command from the SDK.
      */
-    addResponseHeadersPolicy(policy) {
-        this.responseHeadersPolicies.add(policy);
+    async getFunction(command, options) {
+        return await this.commands.functions.getFunction(command, options);
     }
     /**
-     * Forget a simulated response headers policy.
+     * Get a sim CloudFront Function by ARN.
      */
-    removeResponseHeadersPolicy(policyId) {
-        this.responseHeadersPolicies.remove(policyId);
+    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
+        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
+        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
     }
     /**
-     * Get a simulated response headers policy by ID.
+     * Get a sim CloudFront Function by name.
      */
-    getResponseHeadersPolicyById(policyId) {
-        return this.responseHeadersPolicies.byId(policyId);
+    getCloudFrontFunctionByName(cloudFrontFunctionName) {
+        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
     }
     /**
      * Store a simulated origin access control.

package/dist/service/ecr/authorize/sim-ecr-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimEcrRepositoryAddress } from "../repository/sim-ecr-repository-address.js";
+interface SimEcrAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly address: SimEcrRepositoryAddress;
+}
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export declare class SimEcrAuthorizer {
+    private readonly iam;
+    private readonly address;
+    constructor(properties: SimEcrAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action: string, repositoryName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/ecr/authorize/sim-ecr-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export class SimEcrAuthorizer {
+    iam;
+    address;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.address = properties.address;
+    }
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action, repositoryName, caller) {
+        const resource = this.address.arn(repositoryName);
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource,
+            });
+        }
+        return decision.caller;
+    }
+}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts

@@ -1,9 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimEcrAuthorizer } from "../../authorize/sim-ecr-authorizer.js";
 import type { SimEcrRepository } from "../../repository/sim-ecr-repository.js";
 import type { SimEcr } from "../../sim-ecr.js";
 interface SimCfnEcrRepositoryCreatorProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * Creates simulated repositories from AWS::ECR::Repository Resources.
@@ -16,11 +19,17 @@ interface SimCfnEcrRepositoryCreatorProperties {
  */
 export declare class SimCfnEcrRepositoryCreator {
     private readonly ecr;
+    private readonly authorizer;
     constructor(properties: SimCfnEcrRepositoryCreatorProperties);
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimEcrRepository;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimEcrRepository;
     /**
      * Delete a repository created from an AWS::ECR::Repository Resource.
      *
@@ -37,6 +46,6 @@ export declare class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource: SimCfnResource, repository: SimEcrRepository): void;
+    delete(resource: SimCfnResource, repository: SimEcrRepository, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.js

@@ -10,19 +10,27 @@ import { SimCfnEcrRepositoryProperties } from "./sim-cfn-ecr-repository-properti
  */
 export class SimCfnEcrRepositoryCreator {
     ecr;
+    authorizer;
     constructor(properties) {
         this.ecr = properties.ecr;
+        this.authorizer = properties.authorizer;
     }
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
         const repositoryProperties = new SimCfnEcrRepositoryProperties({
             resource,
             properties,
         });
         const repositoryName = repositoryProperties.repositoryName();
         repositoryProperties.recordIgnoredProperties();
+        this.authorizer.authorizeRepository("ecr:CreateRepository", repositoryName, options?.caller);
         return this.ecr.repository(repositoryName);
     }
     /**
@@ -41,7 +49,8 @@ export class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource, repository) {
+    delete(resource, repository, options) {
+        this.authorizer.authorizeRepository("ecr:DeleteRepository", repository.repositoryName, options?.caller);
         if (repository.hasImage) {
             throw new Error(`Unsupported sim ECR CloudFormation Resource ${resource.logicalId} ` +
                 `deletion: the simulated ECR repository ` +

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.d.ts

@@ -1,8 +1,10 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimEcrAuthorizer } from "../authorize/sim-ecr-authorizer.js";
 import type { SimEcr } from "../sim-ecr.js";
 interface SimEcrCfnResourceFactoryProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * CloudFormation Resource factory for simulated ECR resources.
@@ -21,6 +23,6 @@ export declare class SimEcrCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.js

@@ -1,5 +1,7 @@
 import { assertDefined } from "../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-creator.js";
+import { unsupportedSimEcrResourceType } from "./sim-ecr-cfn-unsupported-resource.js";
 /**
  * CloudFormation Resource factory for simulated ECR resources.
  *
@@ -10,30 +12,27 @@ import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-
 export class SimEcrCfnResourceFactory {
     repositoryCreator;
     constructor(properties) {
-        this.repositoryCreator = new SimCfnEcrRepositoryCreator({
-            ecr: properties.ecr,
-        });
+        this.repositoryCreator = new SimCfnEcrRepositoryCreator(properties);
     }
     /**
      * Create a simulated ECR resource from a CloudFormation Resource.
      */
     create(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, "");
         }
-        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties));
+        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller)));
     }
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName, resource) {
+    delete(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName} ` +
-                `deletion`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, " deletion");
         }
         const repository = resource.simResource;
         assertDefined(repository, `sim ECR repository for CloudFormation Resource ${resource.logicalId}`);
-        this.repositoryCreator.delete(resource, repository);
+        this.repositoryCreator.delete(resource, repository, simCfnResourceCallerOptions(context.caller));
         return Promise.resolve();
     }
 }

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export declare function unsupportedSimEcrResourceType(resourceTypeName: string, suffix: string): Error;

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.js

@@ -0,0 +1,9 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export function unsupportedSimEcrResourceType(resourceTypeName, suffix) {
+    return new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}${suffix}`);
+}

package/dist/service/ecr/sim-ecr.d.ts

@@ -1,9 +1,11 @@
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import type { SimEcrRepository } from "./repository/sim-ecr-repository.js";
 interface SimEcrProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly registry?: SimEcrRegistry;
 }
 /**
@@ -19,6 +21,11 @@ interface SimEcrProperties {
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export declare class SimEcr {
     private readonly repositories;

package/dist/service/ecr/sim-ecr.js

@@ -1,4 +1,6 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
+import { SimEcrAuthorizer } from "./authorize/sim-ecr-authorizer.js";
 import { SimEcrCfnResourceFactory } from "./cfn/sim-ecr-cfn-resource-factory.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import { SimEcrRepositoryAddress } from "./repository/sim-ecr-repository-address.js";
@@ -16,15 +18,25 @@ import { SimEcrRepositoryStore } from "./repository/sim-ecr-repository-store.js"
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export class SimEcr {
     repositories;
-    cfnFactory = new SimEcrCfnResourceFactory({ ecr: this });
+    cfnFactory;
     constructor(properties = {}) {
         const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), registry = new SimEcrRegistry(), } = properties;
-        this.repositories = new SimEcrRepositoryStore({
-            address: new SimEcrRepositoryAddress(accountRegionScope),
-            registry,
+        const address = new SimEcrRepositoryAddress(accountRegionScope);
+        this.repositories = new SimEcrRepositoryStore({ address, registry });
+        this.cfnFactory = new SimEcrCfnResourceFactory({
+            ecr: this,
+            authorizer: new SimEcrAuthorizer({
+                iam: simIamInRegion(properties.iam, accountRegionScope.regionName),
+                address,
+            }),
         });
     }
     /**

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.d.ts

@@ -18,11 +18,23 @@ interface SimEcsAuthorizerProperties {
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export declare class SimEcsAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEcsAuthorizerProperties);
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEcsRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.
      *

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.js

@@ -1,5 +1,7 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
 import { SimEcsAccessDeniedException } from "../../error/sim-ecs.error.js";
+import { simEcsTasksServicePrincipal } from "../../sim-ecs-service-principal.js";
 /**
  * The resource an ECS action with no resource type authorizes against.
  *
@@ -24,12 +26,31 @@ const noResource = "*";
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export class SimEcsAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEcsTasksServicePrincipal,
+            denied: (denial) => new SimEcsAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.

package/dist/service/ecs/command/register-task-definition/register-task-definition.handler.js

@@ -47,6 +47,7 @@ export class RegisterTaskDefinitionCommandHandler extends SimEcsCommandHandler {
         const settings = new SimEcsTaskDefinitionSettings(command.input);
         await this.sequence();
         const caller = this.authorizer.authorizeAnyResource("ecs:RegisterTaskDefinition", options);
+        this.authorizer.authorizePassRole([settings.taskRoleArn, settings.executionRoleArn], options);
         const familyRevisions = this.taskDefinitions.family(family);
         const revision = familyRevisions.nextRevisionNumber();
         const taskDefinition = new SimEcsTaskDefinition({

package/dist/service/ecs/sim-ecs-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export declare const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/ecs/sim-ecs-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.d.ts

@@ -16,6 +16,11 @@ interface SimEventBridgeAuthorizerProperties {
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -24,7 +29,14 @@ interface SimEventBridgeAuthorizerProperties {
 export declare class SimEventBridgeAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEventBridgeAuthorizerProperties);
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.
      *

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { simEventBridgeServicePrincipal } from "../../delivery/sim-event-bridge-delivery.js";
 import { SimEventBridgeAccessDeniedException } from "../../error/sim-event-bridge.error.js";
 /**
  * The resource an action with no resource type authorizes against.
@@ -20,6 +22,11 @@ const noResource = "*";
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -28,8 +35,22 @@ const noResource = "*";
 export class SimEventBridgeAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEventBridgeServicePrincipal,
+            denied: (denial) => new SimEventBridgeAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.d.ts

@@ -19,6 +19,12 @@ interface SimEventBridgeRuleAccessProperties {
     readonly authorizer: SimEventBridgeAuthorizer;
     readonly accountRegionScope: SimAwsAccountRegionScope;
 }
+/**
+ * The part of a target that names a Role.
+ */
+interface SimEventBridgeTargetRole {
+    readonly RoleArn?: string | undefined;
+}
 interface SimEventBridgeRuleRequest {
     readonly Name?: string | undefined;
     readonly EventBusName?: string | undefined;
@@ -48,6 +54,13 @@ export declare class SimEventBridgeRuleAccess {
      * Ensure the caller may perform an action on a rule, which need not exist.
      */
     authorize(action: string, requested: SimEventBridgeRequestedRule, options?: SimEventBridgeRequestOptions): void;
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets: readonly SimEventBridgeTargetRole[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.js

@@ -37,6 +37,15 @@ export class SimEventBridgeRuleAccess {
     authorize(action, requested, options) {
         this.authorizer.authorizeBus(action, this.arnFor(requested), options);
     }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets, options) {
+        this.authorizer.authorizePassRole(targets.map((target) => target.RoleArn), options);
+    }
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/target/sim-event-bridge-put-targets.js

@@ -33,6 +33,7 @@ export class SimEventBridgePutTargets {
         for (const target of requested) {
             refuseUnsimulatedTargetInput(target);
         }
+        this.access.authorizePassRole(requested, options);
         const added = requested.map((target) => SimEventTarget.of(target));
         refuseRepeatedTargetIds(added);
         const busName = rule.busName.value;

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.d.ts

@@ -11,10 +11,22 @@ interface SimFirehoseAuthorizerProperties {
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export declare class SimFirehoseAuthorizer {
     private readonly iam;
+    private readonly passRole;
     constructor(properties: SimFirehoseAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], caller?: SimAwsCaller): void;
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its
      * ARN.