@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/iam/policy/sim-iam-policy-document-of-size.js

@@ -0,0 +1,41 @@
+import { jsonStringify } from "../../../util/type-guard/json.js";
+/**
+ * Build a policy document IAM would measure at exactly this many characters.
+ *
+ * A test about IAM's character limits has a size to state rather than a
+ * statement. Padding an ARN leaves a document IAM would otherwise take, so the
+ * size is the only thing the command is being asked about. The size is the one
+ * IAM counts, of the document written compactly, and a caller is free to
+ * indent what it hands over.
+ */
+export function simIamPolicyDocumentOfSize(characters) {
+    return padded(characters, (padding) => ({
+        Version: "2012-10-17",
+        Statement: {
+            Effect: "Allow",
+            Action: "s3:GetObject",
+            Resource: `arn:aws:s3:::reports-bucket/${padding}`,
+        },
+    }));
+}
+/**
+ * Build a Role trust policy document of exactly this many characters.
+ *
+ * A trust policy carries a Principal and no Resource, so it is padded through
+ * a Sid instead.
+ */
+export function simIamTrustPolicyDocumentOfSize(characters) {
+    return padded(characters, (padding) => ({
+        Version: "2012-10-17",
+        Statement: {
+            Sid: padding,
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    }));
+}
+function padded(characters, make) {
+    const unpadded = jsonStringify(make("")).length;
+    return make("x".repeat(characters - unpadded));
+}

package/dist/service/iam/role/sim-iam-deploy-role.d.ts

@@ -0,0 +1,56 @@
+import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimPutRolePolicyCommand, SimPutRolePolicyCommandOutput } from "../command/policy/put-role-policy/put-role-policy.command.js";
+import type { SimCreateRoleCommand, SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+/**
+ * A permissions policy for a deploy Role.
+ *
+ * The parsed document a CDK app answers with, or the JSON string a template,
+ * a file or the SDK carries it as.
+ */
+export type SimIamDeployRolePolicy = SimIamPolicyDocument | string;
+/**
+ * What making a Role for a deployment to run as takes.
+ */
+export interface SimIamDeployRoleInput {
+    /**
+     * The name to create the Role under.
+     */
+    readonly roleName: string;
+    /**
+     * What the deployment is allowed to do.
+     *
+     * Several documents go on the Role as several inline policies. A policy
+     * split in two to stay under IAM's size cap is passed on whole.
+     */
+    readonly policyDocument: SimIamDeployRolePolicy | readonly SimIamDeployRolePolicy[];
+}
+/**
+ * The IAM commands making a deploy Role takes.
+ */
+interface SimIamDeployRoleCommands {
+    createRole(command: SimCreateRoleCommand): Promise<SimCreateRoleCommandOutput>;
+    putRolePolicy(command: SimPutRolePolicyCommand): Promise<SimPutRolePolicyCommandOutput>;
+}
+/**
+ * Makes the Role a simulated CloudFormation deployment runs as.
+ *
+ * A project that scopes its own deploy permissions has the policy document
+ * already and wants a caller to pass to `deployTemplate`, `deployTemplateFile`
+ * or `deployCdkOut`. Getting from one to the other is a Role with the trust
+ * CloudFormation needs, the document on it, and the Role's ARN. The trust is
+ * the same every time and the ARN follows from the name. Neither is asked for.
+ */
+export declare class SimIamDeployRoleMaker {
+    private readonly commands;
+    constructor(commands: SimIamDeployRoleCommands);
+    /**
+     * Create the Role and answer with the caller a deployment names it by.
+     *
+     * Each document goes on as an inline policy of its own, under a numbered
+     * name. A policy split in two to fit IAM's cap has no second name of its
+     * own.
+     */
+    make(input: SimIamDeployRoleInput): Promise<SimArnPrincipal>;
+}
+export {};

package/dist/service/iam/role/sim-iam-deploy-role.js

@@ -0,0 +1,50 @@
+import { jsonStringify } from "../../../util/type-guard/json.js";
+/**
+ * The trust a Role needs for CloudFormation to deploy as it.
+ */
+const deploymentTrustPolicy = jsonStringify({
+    Version: "2012-10-17",
+    Statement: {
+        Effect: "Allow",
+        Principal: { Service: "cloudformation.amazonaws.com" },
+        Action: "sts:AssumeRole",
+    },
+});
+/**
+ * Makes the Role a simulated CloudFormation deployment runs as.
+ *
+ * A project that scopes its own deploy permissions has the policy document
+ * already and wants a caller to pass to `deployTemplate`, `deployTemplateFile`
+ * or `deployCdkOut`. Getting from one to the other is a Role with the trust
+ * CloudFormation needs, the document on it, and the Role's ARN. The trust is
+ * the same every time and the ARN follows from the name. Neither is asked for.
+ */
+export class SimIamDeployRoleMaker {
+    commands;
+    constructor(commands) {
+        this.commands = commands;
+    }
+    /**
+     * Create the Role and answer with the caller a deployment names it by.
+     *
+     * Each document goes on as an inline policy of its own, under a numbered
+     * name. A policy split in two to fit IAM's cap has no second name of its
+     * own.
+     */
+    async make(input) {
+        const creation = await this.commands.createRole({
+            input: {
+                RoleName: input.roleName,
+                AssumeRolePolicyDocument: deploymentTrustPolicy,
+            },
+        });
+        await Promise.all([input.policyDocument].flat().map((document, index) => this.commands.putRolePolicy({
+            input: {
+                RoleName: input.roleName,
+                PolicyName: `${input.roleName}-policy-${index + 1}`,
+                PolicyDocument: typeof document === "string" ? document : jsonStringify(document),
+            },
+        })));
+        return { kind: "arn", arn: creation.Role.Arn };
+    }
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -19,7 +19,9 @@ export interface SimIamRoleWithPolicyInput {
      *
      * A simulation given a default caller attributes these two commands to it,
      * and a Role being created for that caller has no policies to allow them
-     * yet. Naming the Account root here is how such a test bootstraps.
+     * yet. Naming the Account root here is one way for such a test to bootstrap.
+     * Calling inside `simAws.runAs(simAws.account().rootPrincipal, ...)` is the
+     * other, and covers everything else the block does as well.
      */
     readonly caller?: SimAwsCaller | undefined;
 }

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -2,6 +2,7 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import type { SimAwsDefaultCaller } from "../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../aws/caller/sim-aws-ambient-caller.js";
 import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
@@ -27,6 +28,13 @@ export interface SimIamProperties {
      * decided as the Account root, which is what a standalone SimIam does.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A SimAws passes on the run-as block it is inside, if any. A standalone
+     * SimIam has no run-as around it and leaves this out.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves the IAM of other Accounts in the same simulation.
      *

package/dist/service/iam/sim-iam-account-parts.js

@@ -48,6 +48,7 @@ export class SimIamAccountParts {
             users: this.users,
             credentialIdentityResolver: credentialRegistry,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/sim-iam.d.ts

@@ -3,7 +3,7 @@ import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
-import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-input.js";
 import type { SimIamPolicyDecision } from "./authorize/sim-iam-decision.js";
 import type * as simIamCommands from "./command/sim-iam-command.types.js";
 import type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
@@ -11,11 +11,12 @@ import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/fa
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
 import type { SimIamAccountIdentityPolicies } from "./authorize/identity/sim-iam-account-identity-policies.js";
 import type { SimIamAuthZPolicySource } from "./authorize/context/sim-iam-auth-z-context.js";
-import type { SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
+import type { SimArnPrincipal, SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
 import type { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
 import { type SimIamProperties } from "./sim-iam-account-parts.js";
+import { type SimIamDeployRoleInput } from "./role/sim-iam-deploy-role.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -52,6 +53,7 @@ export declare class SimIam implements SimIamInterServiceAuthZ, SimIamAccountIde
     private readonly commands;
     private readonly accountAuthZ;
     private readonly sdkRouter;
+    private readonly deployRoles;
     constructor(properties?: SimIamProperties);
     /**
      * Evaluate an IAM authorization attempt against policies relevant to the
@@ -140,6 +142,14 @@ export declare class SimIam implements SimIamInterServiceAuthZ, SimIamAccountIde
      * Handle an IAM CreateAccessKey command.
      */
     createAccessKey(command: simIamCommands.SimCreateAccessKeyCommand, options?: SimIamRequestOptions): Promise<simIamCommands.SimCreateAccessKeyCommandOutput>;
+    /**
+     * Make a Role for a CloudFormation deployment to run as.
+     *
+     * The Role is trusted by `cloudformation.amazonaws.com` and allowed what the
+     * policy documents allow. What comes back goes straight to `caller` on
+     * `deployTemplate`, `deployTemplateFile` or `deployCdkOut`.
+     */
+    makeDeployRole(input: SimIamDeployRoleInput): Promise<SimArnPrincipal>;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/iam/sim-iam.js

@@ -1,6 +1,7 @@
 import { SimIamCloudFormationResourceFactory } from "./cfn/sim-cfn-iam-resource-factory.js";
 import { SimIamSdkCommandRouter } from "./sdk/sim-iam-sdk-command-router.js";
 import { SimIamAccountParts, } from "./sim-iam-account-parts.js";
+import { SimIamDeployRoleMaker, } from "./role/sim-iam-deploy-role.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -37,6 +38,7 @@ export class SimIam {
     commands;
     accountAuthZ;
     sdkRouter = new SimIamSdkCommandRouter(this);
+    deployRoles = new SimIamDeployRoleMaker(this);
     constructor(properties = {}) {
         const parts = new SimIamAccountParts(properties);
         this.accountId = parts.accountId;
@@ -176,6 +178,16 @@ export class SimIam {
     async createAccessKey(command, options) {
         return await this.commands.users.createAccessKey(command, options);
     }
+    /**
+     * Make a Role for a CloudFormation deployment to run as.
+     *
+     * The Role is trusted by `cloudformation.amazonaws.com` and allowed what the
+     * policy documents allow. What comes back goes straight to `caller` on
+     * `deployTemplate`, `deployTemplateFile` or `deployCdkOut`.
+     */
+    async makeDeployRole(input) {
+        return await this.deployRoles.make(input);
+    }
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/iam/validate/size/sim-iam-policy-document-size.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The longest managed policy document IAM will take.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+export declare const maxSimIamManagedPolicyCharacters = 6144;
+/**
+ * The longest inline policy document IAM will take on a Role or a User.
+ */
+export declare const maxSimIamInlinePolicyCharacters = 10240;
+/**
+ * The longest trust policy document IAM will take on a Role.
+ *
+ * This one is adjustable, up to 8,192 characters. A simulation holds the
+ * default an account carries until it asks for more.
+ */
+export declare const maxSimIamTrustPolicyCharacters = 2048;
+/**
+ * The Role or the User an inline policy is being put onto.
+ */
+export interface SimIamPolicyDocumentHolder {
+    /**
+     * What IAM calls the holder in the message, `role` or `user`.
+     */
+    readonly kind: "role" | "user";
+    /**
+     * The holder's name.
+     */
+    readonly name: string;
+}
+/**
+ * Measure a policy document the way IAM does, which leaves whitespace out.
+ *
+ * A document indented for a reader therefore counts the same as the one line
+ * `JSON.stringify` produces, and a template can be written either way.
+ */
+export declare function simIamPolicyDocumentSize(policyDocument: string): number;
+/**
+ * Refuse a managed policy document over the character limit.
+ *
+ * A policy past the limit cannot be deployed, and the account keeps whichever
+ * version last fit. The permission the document was grown to grant then goes
+ * missing weeks later, at a distance from the change that lost it. Refusing
+ * the document here puts the fault beside the policy that carries it.
+ *
+ * The requiredness check refuses an absent document. This one has nothing to
+ * measure.
+ */
+export declare function assertSimIamManagedPolicyWithinSizeLimit(policyDocument: string | undefined): void;
+/**
+ * Refuse an inline policy document over the character limit.
+ */
+export declare function assertSimIamInlinePolicyWithinSizeLimit(policyDocument: string | undefined, holder: SimIamPolicyDocumentHolder): void;
+/**
+ * Refuse a Role trust policy document over the character limit.
+ */
+export declare function assertSimIamTrustPolicyWithinSizeLimit(policyDocument: string | undefined, roleName: string): void;

package/dist/service/iam/validate/size/sim-iam-policy-document-size.js

@@ -0,0 +1,71 @@
+import { SimIamLimitExceeded } from "../../error/sim-iam.error.js";
+/**
+ * The longest managed policy document IAM will take.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+export const maxSimIamManagedPolicyCharacters = 6144;
+/**
+ * The longest inline policy document IAM will take on a Role or a User.
+ */
+export const maxSimIamInlinePolicyCharacters = 10_240;
+/**
+ * The longest trust policy document IAM will take on a Role.
+ *
+ * This one is adjustable, up to 8,192 characters. A simulation holds the
+ * default an account carries until it asks for more.
+ */
+export const maxSimIamTrustPolicyCharacters = 2048;
+/**
+ * Measure a policy document the way IAM does, which leaves whitespace out.
+ *
+ * A document indented for a reader therefore counts the same as the one line
+ * `JSON.stringify` produces, and a template can be written either way.
+ */
+export function simIamPolicyDocumentSize(policyDocument) {
+    return policyDocument.replaceAll(/\s/gu, "").length;
+}
+/**
+ * Refuse a managed policy document over the character limit.
+ *
+ * A policy past the limit cannot be deployed, and the account keeps whichever
+ * version last fit. The permission the document was grown to grant then goes
+ * missing weeks later, at a distance from the change that lost it. Refusing
+ * the document here puts the fault beside the policy that carries it.
+ *
+ * The requiredness check refuses an absent document. This one has nothing to
+ * measure.
+ */
+export function assertSimIamManagedPolicyWithinSizeLimit(policyDocument) {
+    if (policyDocument === undefined ||
+        simIamPolicyDocumentSize(policyDocument) <= maxSimIamManagedPolicyCharacters) {
+        return;
+    }
+    throw new SimIamLimitExceeded(`Cannot exceed quota for PolicySize: ${String(maxSimIamManagedPolicyCharacters)}`);
+}
+/**
+ * Refuse an inline policy document over the character limit.
+ */
+export function assertSimIamInlinePolicyWithinSizeLimit(policyDocument, holder) {
+    assertWithinMaximumPolicySize(policyDocument, maxSimIamInlinePolicyCharacters, holder);
+}
+/**
+ * Refuse a Role trust policy document over the character limit.
+ */
+export function assertSimIamTrustPolicyWithinSizeLimit(policyDocument, roleName) {
+    assertWithinMaximumPolicySize(policyDocument, maxSimIamTrustPolicyCharacters, { kind: "role", name: roleName });
+}
+/**
+ * IAM reports both of these in bytes, over a count that is really characters
+ * with the whitespace taken out. The wording is kept as IAM writes it. A
+ * reader searching for the message finds what a real deploy would have told
+ * them.
+ */
+function assertWithinMaximumPolicySize(policyDocument, maxCharacters, holder) {
+    if (policyDocument === undefined ||
+        simIamPolicyDocumentSize(policyDocument) <= maxCharacters) {
+        return;
+    }
+    throw new SimIamLimitExceeded(`Maximum policy size of ${String(maxCharacters)} bytes exceeded for ` +
+        `${holder.kind} ${holder.name}`);
+}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -20,7 +20,9 @@ interface SimKmsAuthorizerProperties {
  * Both carry the KMS condition values a key policy can be written against:
  * `kms:CallerAccount` for the Account the request came from, and
  * `kms:ViaService` where another service made the request on the caller's
- * behalf.
+ * behalf. A service passing on the caller's own KMS permissions says so, and
+ * a key policy admitting whoever the request came from is then not enough by
+ * itself.
  */
 export declare class SimKmsAuthorizer {
     private readonly iam;

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -15,7 +15,9 @@ import { SimKmsViaService } from "../../key/sim-kms-via-service.js";
  * Both carry the KMS condition values a key policy can be written against:
  * `kms:CallerAccount` for the Account the request came from, and
  * `kms:ViaService` where another service made the request on the caller's
- * behalf.
+ * behalf. A service passing on the caller's own KMS permissions says so, and
+ * a key policy admitting whoever the request came from is then not enough by
+ * itself.
  */
 export class SimKmsAuthorizer {
     iam;
@@ -41,6 +43,7 @@ export class SimKmsAuthorizer {
             callerConditions: this.callerAccount,
             resourcePolicies: [key.policy.asResourcePolicy()],
             requiresResourcePolicyAllow: true,
+            withCallerPermissions: options.withCallerPermissions,
         });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({

package/dist/service/kms/command/sim-kms-request-options.d.ts

@@ -20,4 +20,15 @@ export interface SimKmsRequestOptions {
      * and a policy conditioned on `kms:ViaService` then does not match.
      */
     readonly viaService?: string | undefined;
+    /**
+     * Whether the service named by `viaService` is making the request with the
+     * caller's own KMS permissions rather than with its own.
+     *
+     * Parameter Store decrypts a SecureString this way. A caller holding
+     * ssm:GetParameter and no kms:Decrypt is refused even under the aws/ssm key,
+     * whose policy admits the Account's principals reaching KMS through Systems
+     * Manager. A key policy naming the caller still allows the request on its
+     * own, as it does for any other KMS request.
+     */
+    readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/kms/key/sim-kms-key-policy.d.ts

@@ -1,5 +1,5 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
 import { type SimKmsViaService } from "./sim-kms-via-service.js";
 /**
@@ -38,9 +38,10 @@ export declare class SimKmsKeyPolicy {
      * through the service that owns the key, and it delegates nothing else to
      * IAM: the second statement covers reading the key's metadata and no more.
      *
-     * That is what makes an AWS managed key usable by a caller holding no KMS
-     * permission at all, and unusable by a caller holding kms:Decrypt on it who
-     * calls KMS directly.
+     * That is what makes an AWS managed key unusable by a caller holding
+     * kms:Decrypt on it who calls KMS directly. What the first statement admits
+     * is whoever reached KMS through the owning service, which allows the
+     * request on its own only where that service used its own permissions.
      */
     static awsManaged(keyArn: string, accountId: SimAwsAccountId, viaService: SimKmsViaService): SimKmsKeyPolicy;
     /**

package/dist/service/kms/key/sim-kms-key-policy.js

@@ -53,9 +53,10 @@ export class SimKmsKeyPolicy {
      * through the service that owns the key, and it delegates nothing else to
      * IAM: the second statement covers reading the key's metadata and no more.
      *
-     * That is what makes an AWS managed key usable by a caller holding no KMS
-     * permission at all, and unusable by a caller holding kms:Decrypt on it who
-     * calls KMS directly.
+     * That is what makes an AWS managed key unusable by a caller holding
+     * kms:Decrypt on it who calls KMS directly. What the first statement admits
+     * is whoever reached KMS through the owning service, which allows the
+     * request on its own only where that service used its own permissions.
      */
     static awsManaged(keyArn, accountId, viaService) {
         return new SimKmsKeyPolicy(keyArn, {

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.d.ts

@@ -48,8 +48,8 @@ export declare class SimCfnLambdaFunctionPropertiesParser {
      */
     private roleArn;
     /**
-     * The function name defaults to the logical ID, as CloudFormation
-     * effectively names unnamed functions from it.
+     * An unnamed function gets the name CloudFormation generates for it, from
+     * the stack name and the logical ID.
      */
     private functionName;
 }

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.js

@@ -3,6 +3,7 @@ import { SimCfnLambdaDeadLetterParser } from "./sim-cfn-lambda-dead-letter-parse
 import { SimCfnLambdaEnvironmentParser } from "./sim-cfn-lambda-environment-parser.js";
 import { SimCfnLambdaFunctionCodeParser } from "./sim-cfn-lambda-function-code-parser.js";
 import { SimCfnLambdaPropertyParser } from "./sim-cfn-lambda-property-parser.js";
+import { simCfnLambdaGeneratedFunctionName } from "./sim-cfn-lambda-generated-function-name.js";
 /**
  * Map parsed AWS::Lambda::Function properties onto the sim Lambda
  * CreateFunction command input, with the code input resolved separately so
@@ -74,10 +75,10 @@ export class SimCfnLambdaFunctionPropertiesParser {
         });
     }
     /**
-     * The function name defaults to the logical ID, as CloudFormation
-     * effectively names unnamed functions from it.
+     * An unnamed function gets the name CloudFormation generates for it, from
+     * the stack name and the logical ID.
      */
     functionName(resource, properties) {
-        return (this.propertyParser.optionalString(resource, properties["FunctionName"], "FunctionName") ?? resource.logicalId);
+        return (this.propertyParser.optionalString(resource, properties["FunctionName"], "FunctionName") ?? simCfnLambdaGeneratedFunctionName(resource));
     }
 }

package/dist/service/lambda/cfn/function/sim-cfn-lambda-generated-function-name.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a function whose template does not name it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since Lambda keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one a function name allows.
+ */
+export declare function simCfnLambdaGeneratedFunctionName(resource: SimCfnResource): string;

package/dist/service/lambda/cfn/function/sim-cfn-lambda-generated-function-name.js

@@ -0,0 +1,25 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+/**
+ * The longest name Lambda accepts for a function.
+ *
+ * The 140 characters `CreateFunction` documents are for a full ARN. A bare
+ * function name gets 64, and that is what a template generates.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html
+ */
+const maximumNameLength = 64;
+/**
+ * The name CloudFormation gives a function whose template does not name it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since Lambda keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one a function name allows.
+ */
+export function simCfnLambdaGeneratedFunctionName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value;
+}

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimLambdaPolicyResource } from "../../function/policy/sim-lambda-policy-resource.js";
 /**
  * The resource policies IAM should evaluate alongside identity policies for an

package/dist/service/lambda/command/create-function/create-function-authorizer.d.ts

@@ -8,18 +8,25 @@ interface CreateFunctionAuthorizerProperties {
  *
  * AWS maps the CreateFunction API operation to the lambda:CreateFunction IAM
  * action. The resource is the function ARN being created.
+ *
+ * The execution role is a second question. Lambda keeps that Role and runs the
+ * function as it later, so the caller is asked whether they may hand it over,
+ * against the Role rather than the function. The create action is decided
+ * first, which is the order the two answers come in on real AWS.
  */
 export declare class CreateFunctionAuthorizer {
     private static readonly action;
     private readonly iam;
+    private readonly passRole;
     constructor(properties: CreateFunctionAuthorizerProperties);
     /**
-     * Ensure the caller may create a Lambda function with the given ARN.
+     * Ensure the caller may create a Lambda function with the given ARN, and may
+     * hand Lambda the execution role it names.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn: string, caller?: SimAwsCaller): void;
+    authorize(functionArn: string, roleArn: string, caller?: SimAwsCaller): void;
 }
 export {};

package/dist/service/lambda/command/create-function/create-function-authorizer.js

@@ -1,24 +1,37 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simLambdaServicePrincipal } from "../../sim-lambda-service-principal.js";
 /**
  * Applies IAM authorization to a Lambda CreateFunction request.
  *
  * AWS maps the CreateFunction API operation to the lambda:CreateFunction IAM
  * action. The resource is the function ARN being created.
+ *
+ * The execution role is a second question. Lambda keeps that Role and runs the
+ * function as it later, so the caller is asked whether they may hand it over,
+ * against the Role rather than the function. The create action is decided
+ * first, which is the order the two answers come in on real AWS.
  */
 export class CreateFunctionAuthorizer {
     static action = "lambda:CreateFunction";
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simLambdaServicePrincipal,
+        });
     }
     /**
-     * Ensure the caller may create a Lambda function with the given ARN.
+     * Ensure the caller may create a Lambda function with the given ARN, and may
+     * hand Lambda the execution role it names.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn, caller) {
+    authorize(functionArn, roleArn, caller) {
         const decision = this.iam.authorize({
             action: CreateFunctionAuthorizer.action,
             resource: functionArn,
@@ -32,5 +45,6 @@ export class CreateFunctionAuthorizer {
                 resource: functionArn,
             });
         }
+        this.passRole.authorize(roleArn, caller);
     }
 }