@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simFirehoseServicePrincipal } from "../../sim-firehose-service-principal.js";
 /**
  * Applies simulated IAM authorization to Firehose requests.
  *
@@ -6,11 +8,29 @@ import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export class SimFirehoseAuthorizer {
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simFirehoseServicePrincipal,
+        });
+    }
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns, caller) {
+        this.passRole.authorizeAll(roleArns, caller);
     }
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.d.ts

@@ -38,6 +38,10 @@ export declare class SimFirehoseDeliveryStreamAccess {
      * stream.
      */
     authorizeAny(action: string, options?: SimFirehoseRequestOptions): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimFirehoseRequestOptions): void;
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.js

@@ -37,6 +37,12 @@ export class SimFirehoseDeliveryStreamAccess {
     authorizeAny(action, options) {
         return this.authorizer.authorizeAnyDeliveryStream(action, options?.caller);
     }
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns, options) {
+        this.authorizer.authorizePassRole(roleArns, options?.caller);
+    }
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/stream/sim-firehose-create-delivery-stream.js

@@ -44,11 +44,13 @@ export class SimFirehoseCreateDeliveryStream {
         this.requireNameFree(name);
         const createdAt = this.background.now();
         const source = simFirehoseSourceOf(input, this.scope, createdAt);
+        const destination = simFirehoseDestinationOf(input);
+        this.access.authorizePassRole([destination.roleArn, source.roleArn], options);
         const arn = simFirehoseDeliveryStreamArn(this.scope, name);
         const deliveryStream = new SimFirehoseDeliveryStream({
             name,
             arn,
-            destination: simFirehoseDestinationOf(input),
+            destination,
             source,
             createdAt,
         });

package/dist/service/firehose/sim-firehose-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export declare const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/sim-firehose-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/source/sim-firehose-source.d.ts

@@ -14,6 +14,11 @@ export type SimFirehoseDeliveryStreamType = "DirectPut" | "KinesisStreamAsSource
 export declare class SimFirehoseDirectPutSource {
     readonly kind: "direct-put";
     readonly deliveryStreamType: "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    readonly roleArn: undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/firehose/source/sim-firehose-source.js

@@ -5,6 +5,11 @@ import { SimFirehoseInvalidArgumentException } from "../error/sim-firehose.error
 export class SimFirehoseDirectPutSource {
     kind = "direct-put";
     deliveryStreamType = "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    roleArn = undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/glue/cfn/database/sim-cfn-glue-database-properties.js

@@ -1,6 +1,7 @@
 import { glueCfnPropertyError } from "../sim-cfn-glue-property-error.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueDatabaseRules } from "./sim-cfn-glue-database-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Database";
 /**
  * Reads AWS::Glue::Database CloudFormation properties.
@@ -28,10 +29,9 @@ export class SimCfnGlueDatabaseProperties {
      */
     databaseName() {
         const values = this.#values;
-        const stackName = this.#resource.stackName ?? "stack";
         return (values.optionalString(this.#input()["Name"], "DatabaseInput.Name") ??
             values.optionalString(this.#properties["DatabaseName"], "DatabaseName") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+            simCfnGlueGeneratedName(this.#resource));
     }
     /** What the database is created with, beyond its name. */
     databaseInput() {

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export declare function simCfnGlueGeneratedName(resource: SimCfnResource): string;

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.js

@@ -0,0 +1,25 @@
+import { SimCfnGeneratedResourceName } from "../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { simGlueFolded } from "../database/sim-glue-catalog-name.js";
+/**
+ * The longest name the Data Catalog accepts for a database or a table.
+ *
+ * Glue states the limit in UTF-8 bytes and `SimCfnGeneratedResourceName` trims
+ * by character. The two come to the same thing here. A logical ID is
+ * alphanumeric, a stack name adds only hyphens, and the tail is hex.
+ */
+const maximumNameLength = 255;
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export function simCfnGlueGeneratedName(resource) {
+    return simGlueFolded(new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value);
+}

package/dist/service/glue/cfn/table/sim-cfn-glue-table-properties.js

@@ -3,6 +3,7 @@ import { SimCfnGlueRecord } from "../sim-cfn-glue-record.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueTableInputReader } from "./sim-cfn-glue-table-input.js";
 import { simCfnGlueTableIgnored } from "./sim-cfn-glue-table-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Table";
 /**
  * Reads AWS::Glue::Table CloudFormation properties.
@@ -32,9 +33,7 @@ export class SimCfnGlueTableProperties {
      * since Glue names are lowercase for Hive compatibility.
      */
     tableName() {
-        const stackName = this.#resource.stackName ?? "stack";
-        return (this.#input().string("Name") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+        return (this.#input().string("Name") ?? simCfnGlueGeneratedName(this.#resource));
     }
     /** What the table is created with, beyond its name and its database. */
     tableInput() {

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -6,6 +6,12 @@ interface SimIamAllowSidesProperties {
      * Defaults to the resource side, for callers with no reason to distinguish.
      */
     readonly resourceDirect?: boolean | undefined;
+    /**
+     * Whether a resource-policy Allow named the caller, rather than admitting it
+     * as one of a wider set through a wildcard principal. Defaults to the
+     * resource side in the same way.
+     */
+    readonly resourceNamesCaller?: boolean | undefined;
 }
 /**
  * Which sides of a policy evaluation produced a matching Allow.
@@ -19,6 +25,7 @@ export declare class SimIamAllowSides {
     private readonly identityAllowed;
     private readonly resourceAllowed;
     private readonly resourceDirectAllowed;
+    private readonly resourceNamesCallerAllowed;
     constructor(properties: SimIamAllowSidesProperties);
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +36,8 @@ export declare class SimIamAllowSides {
      */
     get resource(): boolean;
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect(): boolean;
     /**
@@ -38,6 +45,11 @@ export declare class SimIamAllowSides {
      * its Account, which grants nothing on its own.
      */
     get resourceDelegated(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller(): boolean;
 }
 /**
  * Which sides of an authorization must allow a request for it to be allowed.
@@ -97,6 +109,25 @@ export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamA
      */
     isSatisfiedBy(allows: SimIamAllowSides): boolean;
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service. That is the
+ * difference between a key policy naming a Role and the aws/ssm key policy,
+ * which admits the Account's principals reaching KMS through Parameter Store
+ * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
+ * SecureString.
+ */
+export declare class SimIamCallerPermissionRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
 /**
  * Every applicable rule at once.
  *

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -10,11 +10,14 @@ export class SimIamAllowSides {
     identityAllowed;
     resourceAllowed;
     resourceDirectAllowed;
+    resourceNamesCallerAllowed;
     constructor(properties) {
         this.identityAllowed = properties.identity;
         this.resourceAllowed = properties.resource;
         this.resourceDirectAllowed =
             properties.resourceDirect ?? properties.resource;
+        this.resourceNamesCallerAllowed =
+            properties.resourceNamesCaller ?? properties.resource;
     }
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +32,8 @@ export class SimIamAllowSides {
         return this.resourceAllowed;
     }
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect() {
         return this.resourceDirectAllowed;
@@ -42,6 +45,13 @@ export class SimIamAllowSides {
     get resourceDelegated() {
         return this.resourceAllowed && !this.resourceDirectAllowed;
     }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller() {
+        return this.resourceNamesCallerAllowed;
+    }
 }
 /**
  * The same-Account rule: an Allow from either side is enough.
@@ -104,6 +114,27 @@ export class SimIamMandatoryResourcePolicyRequirement {
         return allows.resourceDelegated && allows.identity;
     }
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service. That is the
+ * difference between a key policy naming a Role and the aws/ssm key policy,
+ * which admits the Account's principals reaching KMS through Parameter Store
+ * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
+ * SecureString.
+ */
+export class SimIamCallerPermissionRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows) {
+        return allows.resourceNamesCaller || allows.identity;
+    }
+}
 /**
  * Every applicable rule at once.
  *

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -16,12 +16,13 @@ export declare class SimIamAllowStatements {
     private readonly resourceStatements;
     private readonly trustStatements;
     private readonly delegatedStatements;
+    private readonly namingStatements;
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -13,12 +13,13 @@ export class SimIamAllowStatements {
     resourceStatements = [];
     trustStatements = [];
     delegatedStatements = [];
+    namingStatements = [];
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy, statement, principal) {
         if (policy.sourceType === "trust") {
@@ -27,6 +28,9 @@ export class SimIamAllowStatements {
         if (principal.isAccountDelegation) {
             this.delegatedStatements.push(statement);
         }
+        if (principal.namesCaller) {
+            this.namingStatements.push(statement);
+        }
         this.sideStatements(policy).push(statement);
     }
     /**
@@ -58,10 +62,12 @@ export class SimIamAllowStatements {
      */
     get sides() {
         const delegated = new Set(this.delegatedStatements);
+        const naming = new Set(this.namingStatements);
         return new SimIamAllowSides({
             identity: this.identityStatements.length > 0,
             resource: this.resourceStatements.length > 0,
             resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
+            resourceNamesCaller: this.resourceStatements.some((statement) => naming.has(statement)),
         });
     }
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -1,16 +1,25 @@
 import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * What an authorization request says about the rules it is subject to, beyond
+ * the caller and the policies themselves.
+ */
+export interface SimIamAllowRequirementInput {
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+    readonly withCallerPermissions?: boolean | undefined;
+}
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export declare class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+    resolve(callerAccount: SimIamCallerAccount, input: SimIamAllowRequirementInput): SimIamAllowRequirement;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -1,23 +1,27 @@
-import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+import { SimIamCallerPermissionRequirement, SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount, requiresResourcePolicyAllow) {
-        if (requiresResourcePolicyAllow !== true) {
-            return callerAccount.allowRequirement;
-        }
-        return new SimIamEveryAllowRequirement([
+    resolve(callerAccount, input) {
+        const requirements = [
             callerAccount.allowRequirement,
-            new SimIamMandatoryResourcePolicyRequirement(),
-        ]);
+        ];
+        if (input.requiresResourcePolicyAllow === true) {
+            requirements.push(new SimIamMandatoryResourcePolicyRequirement());
+        }
+        if (input.withCallerPermissions === true) {
+            requirements.push(new SimIamCallerPermissionRequirement());
+        }
+        return new SimIamEveryAllowRequirement(requirements);
     }
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,28 +1,57 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
-import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
+/**
+ * What building a caller context needs beyond the request's own caller.
+ */
+export interface SimIamAuthZCallerContextBuilderProperties {
+    /**
+     * The root principal of the Account deciding the request.
+     *
+     * This is both the last fallback for a request that names no caller and the
+     * principal holding the Account's intrinsic unrestricted access. The default
+     * caller stands apart from it. Naming a default says who an unattributed
+     * call comes from, and leaves the root's own access where AWS puts it.
+     */
+    readonly accountRootPrincipal: SimAwsPrincipal;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * The caller this simulation attributes an unattributed request to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where an unattributed request looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
+}
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export declare class SimIamAuthZCallerContextBuilder {
     private readonly callerResolver;
-    private readonly defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
+    private readonly accountRootPrincipal;
+    private readonly accountRootArn?;
+    constructor(properties: SimIamAuthZCallerContextBuilderProperties);
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller: SimAwsCaller | undefined): SimIamAuthZCallerContext;
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     private rootPolicySources;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -2,34 +2,45 @@ import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolv
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export class SimIamAuthZCallerContextBuilder {
     callerResolver;
-    defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal, credentialIdentityResolver) {
-        this.defaultCallerPrincipal = defaultCallerPrincipal;
-        this.callerResolver = new SimAwsCallerResolver(credentialIdentityResolver);
+    accountRootPrincipal;
+    accountRootArn;
+    constructor(properties) {
+        const root = properties.accountRootPrincipal;
+        this.accountRootPrincipal = root;
+        this.accountRootArn = root.kind === "arn" ? root.arn : undefined;
+        this.callerResolver = new SimAwsCallerResolver({
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
+        });
     }
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller) {
-        const resolvedCaller = this.callerResolver.resolve(caller, this.defaultCallerPrincipal);
+        const resolvedCaller = this.callerResolver.resolve(caller, this.accountRootPrincipal);
         return {
             caller: resolvedCaller,
             rootPolicySources: this.rootPolicySources(resolvedCaller),
         };
     }
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     rootPolicySources(caller) {
-        const defaultCaller = this.callerResolver.resolve(this.defaultCallerPrincipal, this.defaultCallerPrincipal);
-        if (defaultCaller.arn === undefined || caller.arn !== defaultCaller.arn) {
+        if (this.accountRootArn === undefined ||
+            caller.arn !== this.accountRootArn) {
             return [];
         }
         return [