@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/lambda/command/create-function/create-function.handler.js

@@ -51,7 +51,7 @@ export class CreateFunctionCommandHandler {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const functionArn = simLambdaFunctionArn(this.accountRegionScope, input.name);
-        this.authorizer.authorize(functionArn, options?.caller);
+        this.authorizer.authorize(functionArn, input.roleArn, options?.caller);
         this.requireAvailableFunctionName(input.name, functionArn);
         const environment = this.makeEnvironment(input);
         const code = await this.resolveCode(input, environment, options?.caller);

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.d.ts

@@ -9,19 +9,24 @@ interface UpdateFunctionConfigurationAuthorizerProperties {
  * AWS maps the UpdateFunctionConfiguration API operation to the
  * lambda:UpdateFunctionConfiguration IAM action. The resource is the ARN of
  * the function whose settings are changing.
+ *
+ * A request changing the execution role hands Lambda a Role, and is asked
+ * separately whether it may pass that one. A request leaving the role alone
+ * passes nothing and is asked nothing.
  */
 export declare class UpdateFunctionConfigurationAuthorizer {
     private static readonly action;
     private readonly iam;
+    private readonly passRole;
     constructor(properties: UpdateFunctionConfigurationAuthorizerProperties);
     /**
      * Ensure the caller may change the settings of the function with the given
-     * ARN.
+     * ARN, and may hand Lambda an execution role the request replaces it with.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn: string, caller?: SimAwsCaller): void;
+    authorize(functionArn: string, roleArn: string | undefined, caller?: SimAwsCaller): void;
 }
 export {};

package/dist/service/lambda/command/update-function-configuration/update-function-configuration-authorizer.js

@@ -1,26 +1,37 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simLambdaServicePrincipal } from "../../sim-lambda-service-principal.js";
 /**
  * Applies IAM authorization to a Lambda UpdateFunctionConfiguration request.
  *
  * AWS maps the UpdateFunctionConfiguration API operation to the
  * lambda:UpdateFunctionConfiguration IAM action. The resource is the ARN of
  * the function whose settings are changing.
+ *
+ * A request changing the execution role hands Lambda a Role, and is asked
+ * separately whether it may pass that one. A request leaving the role alone
+ * passes nothing and is asked nothing.
  */
 export class UpdateFunctionConfigurationAuthorizer {
     static action = "lambda:UpdateFunctionConfiguration";
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simLambdaServicePrincipal,
+        });
     }
     /**
      * Ensure the caller may change the settings of the function with the given
-     * ARN.
+     * ARN, and may hand Lambda an execution role the request replaces it with.
      *
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorize(functionArn, caller) {
+    authorize(functionArn, roleArn, caller) {
         const decision = this.iam.authorize({
             action: UpdateFunctionConfigurationAuthorizer.action,
             resource: functionArn,
@@ -34,5 +45,6 @@ export class UpdateFunctionConfigurationAuthorizer {
                 resource: functionArn,
             });
         }
+        this.passRole.authorize(roleArn, caller);
     }
 }

package/dist/service/lambda/command/update-function-configuration/update-function-configuration.handler.js

@@ -36,7 +36,7 @@ export class UpdateFunctionConfigurationCommandHandler {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const functionName = simLambdaUnqualifiedFunctionOf(name);
-        this.authorizer.authorize(this.functions.functionArn(functionName), options?.caller);
+        this.authorizer.authorize(this.functions.functionArn(functionName), update.roleArn, options?.caller);
         const simFunction = this.functions.require(functionName);
         simFunction.updateConfiguration(update);
         if (update.environmentVariables !== undefined) {

package/dist/service/lambda/function/logging/sim-lambda-function-logging.d.ts

@@ -55,13 +55,22 @@ export declare class SimLambdaFunctionLogging {
     outputSink(): SimLambdaOutputSink | undefined;
     /**
      * Run an invocation, recording whatever it left unterminated once it is
-     * over.
+     * over, and the error it ended in when it ended in one.
      *
      * The flush happens whether the handler returned or threw, because a handler
      * that logged and then failed is the one a test most wants to read the logs
      * of, and real Lambda records the output either way.
      */
     around<T>(run: () => Promise<T>): Promise<T>;
+    /**
+     * Record an invocation that ended in an error nothing caught, as real
+     * Lambda's runtime records one.
+     *
+     * The caller still gets the error: an Invoke answers with `FunctionError`
+     * and the trace in its payload as before, and this only puts the same
+     * failure in the place code goes looking for it.
+     */
+    private recordInvokeError;
     private coldStart;
 }
 export {};

package/dist/service/lambda/function/logging/sim-lambda-function-logging.js

@@ -1,3 +1,4 @@
+import { simLambdaInvokeErrorLine } from "./sim-lambda-invoke-error-log.js";
 import { SimLambdaLogWriter } from "./sim-lambda-log-writer.js";
 import { simLambdaLogGroupName, simLambdaLogStreamName, } from "./sim-lambda-log-stream-name.js";
 /**
@@ -62,7 +63,7 @@ export class SimLambdaFunctionLogging {
     }
     /**
      * Run an invocation, recording whatever it left unterminated once it is
-     * over.
+     * over, and the error it ended in when it ended in one.
      *
      * The flush happens whether the handler returned or threw, because a handler
      * that logged and then failed is the one a test most wants to read the logs
@@ -72,10 +73,33 @@ export class SimLambdaFunctionLogging {
         try {
             return await run();
         }
+        catch (error) {
+            this.recordInvokeError(error);
+            throw error;
+        }
         finally {
             this.#writer?.flush();
         }
     }
+    /**
+     * Record an invocation that ended in an error nothing caught, as real
+     * Lambda's runtime records one.
+     *
+     * The caller still gets the error: an Invoke answers with `FunctionError`
+     * and the trace in its payload as before, and this only puts the same
+     * failure in the place code goes looking for it.
+     */
+    recordInvokeError(error) {
+        const writer = this.#writer;
+        if (writer === undefined) {
+            return;
+        }
+        // Whatever the handler wrote without closing the line is a line of its
+        // own. A handler that printed half a line before failing would otherwise
+        // have the error appended to it, where a filter for the error misses it.
+        writer.flush();
+        writer.write(simLambdaInvokeErrorLine(error));
+    }
     coldStart() {
         const logStreamName = simLambdaLogStreamName(this.#clock);
         const logs = this.#logs;

package/dist/service/lambda/function/logging/sim-lambda-invoke-error-log.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What real Lambda writes to a function's log group when an invocation ends in
+ * an error nothing caught.
+ *
+ * The runtime prints `ERROR Invoke Error` and a JSON document holding the
+ * error's type, its message and its stack, one array element per frame. The
+ * whole document is one line. CloudWatch Logs records a line as an event, so a
+ * filter matching the message finds every frame with it.
+ *
+ * The keys are the ones the runtime uses. The log line says `stack` where the
+ * Invoke response payload says `trace`, and the two hold the same frames.
+ */
+export declare function simLambdaInvokeErrorLine(error: unknown): string;

package/dist/service/lambda/function/logging/sim-lambda-invoke-error-log.js

@@ -0,0 +1,18 @@
+import { functionErrorDocument } from "../../command/invoke/invoke-payload.js";
+/**
+ * What real Lambda writes to a function's log group when an invocation ends in
+ * an error nothing caught.
+ *
+ * The runtime prints `ERROR Invoke Error` and a JSON document holding the
+ * error's type, its message and its stack, one array element per frame. The
+ * whole document is one line. CloudWatch Logs records a line as an event, so a
+ * filter matching the message finds every frame with it.
+ *
+ * The keys are the ones the runtime uses. The log line says `stack` where the
+ * Invoke response payload says `trace`, and the two hold the same frames.
+ */
+export function simLambdaInvokeErrorLine(error) {
+    const { errorType, errorMessage, trace } = functionErrorDocument(error);
+    const document = JSON.stringify({ errorType, errorMessage, stack: trace });
+    return `ERROR Invoke Error ${document}\n`;
+}

package/dist/service/lambda/sim-lambda-service-principal.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The service principal Lambda holds an execution role as.
+ *
+ * An execution role's trust policy names it, and so does the
+ * `iam:PassedToService` condition a deploy policy is commonly written with.
+ */
+export declare const simLambdaServicePrincipal = "lambda.amazonaws.com";

package/dist/service/lambda/sim-lambda-service-principal.js

@@ -0,0 +1,7 @@
+/**
+ * The service principal Lambda holds an execution role as.
+ *
+ * An execution role's trust policy names it, and so does the
+ * `iam:PassedToService` condition a deploy policy is commonly written with.
+ */
+export const simLambdaServicePrincipal = "lambda.amazonaws.com";

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-authorization.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimLogsAuthorizer } from "../../command/authorize/sim-logs-authorizer.js";
+interface SimCfnDeliveryAuthorizationProperties {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The permissions a CloudFormation delivery Resource handler checks on top of
+ * the API call it makes.
+ *
+ * Each of the three handlers reads its own resource back by name, with
+ * `GetDeliverySource`, `GetDeliveryDestination` or `GetDelivery`. The read
+ * comes before the write, and an execution Role denied it is refused before the
+ * resource exists. The three `Describe` listings belong to the SDK operations
+ * of those names, and no handler goes near one. A policy written from a real
+ * CloudFormation refusal therefore grants the `Get` action, and that policy has
+ * to deploy here.
+ *
+ * The checks sit together because they are the whole of what a deployment's
+ * caller meets before the delivery commands take over.
+ */
+export declare class SimCfnDeliveryAuthorization {
+    #private;
+    constructor(properties: SimCfnDeliveryAuthorizationProperties);
+    /**
+     * Authorize creating an AWS::Logs::DeliverySource.
+     *
+     * The source need not be there. CloudFormation reads the name it is about to
+     * take, and IAM decides the request before CloudWatch Logs answers it.
+     */
+    authorizeDeliverySourceCreate(name: string, caller?: SimAwsCaller): void;
+    /**
+     * Authorize creating an AWS::Logs::DeliveryDestination.
+     */
+    authorizeDeliveryDestinationCreate(name: string, caller?: SimAwsCaller): void;
+    /**
+     * Authorize creating an AWS::Logs::Delivery.
+     *
+     * A delivery carries an identifier CloudWatch Logs has yet to issue. The read
+     * is authorized against every delivery in the scope, the way `CreateDelivery`
+     * itself is.
+     */
+    authorizeDeliveryCreate(caller?: SimAwsCaller): void;
+}
+export {};

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-authorization.js

@@ -0,0 +1,49 @@
+import { simLogsAnyDeliveryArn, simLogsDeliveryDestinationArn, simLogsDeliverySourceArn, } from "../../delivery/sim-logs-delivery-arn.js";
+/**
+ * The permissions a CloudFormation delivery Resource handler checks on top of
+ * the API call it makes.
+ *
+ * Each of the three handlers reads its own resource back by name, with
+ * `GetDeliverySource`, `GetDeliveryDestination` or `GetDelivery`. The read
+ * comes before the write, and an execution Role denied it is refused before the
+ * resource exists. The three `Describe` listings belong to the SDK operations
+ * of those names, and no handler goes near one. A policy written from a real
+ * CloudFormation refusal therefore grants the `Get` action, and that policy has
+ * to deploy here.
+ *
+ * The checks sit together because they are the whole of what a deployment's
+ * caller meets before the delivery commands take over.
+ */
+export class SimCfnDeliveryAuthorization {
+    #authorizer;
+    #scope;
+    constructor(properties) {
+        this.#authorizer = properties.authorizer;
+        this.#scope = properties.accountRegionScope;
+    }
+    /**
+     * Authorize creating an AWS::Logs::DeliverySource.
+     *
+     * The source need not be there. CloudFormation reads the name it is about to
+     * take, and IAM decides the request before CloudWatch Logs answers it.
+     */
+    authorizeDeliverySourceCreate(name, caller) {
+        this.#authorizer.authorizeResource("logs:GetDeliverySource", simLogsDeliverySourceArn(this.#scope, name), caller);
+    }
+    /**
+     * Authorize creating an AWS::Logs::DeliveryDestination.
+     */
+    authorizeDeliveryDestinationCreate(name, caller) {
+        this.#authorizer.authorizeResource("logs:GetDeliveryDestination", simLogsDeliveryDestinationArn(this.#scope, name), caller);
+    }
+    /**
+     * Authorize creating an AWS::Logs::Delivery.
+     *
+     * A delivery carries an identifier CloudWatch Logs has yet to issue. The read
+     * is authorized against every delivery in the scope, the way `CreateDelivery`
+     * itself is.
+     */
+    authorizeDeliveryCreate(caller) {
+        this.#authorizer.authorizeResource("logs:GetDelivery", simLogsAnyDeliveryArn(this.#scope), caller);
+    }
+}

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDelivery } from "../../delivery/sim-logs-delivery.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliveryCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated deliveries from AWS::Logs::Delivery Resources.
@@ -12,6 +14,9 @@ interface SimCfnDeliveryCreatorProperties {
  * A delivery is the join between a source and a destination, and both have to
  * be deployed before it. A template gets that ordering from naming them
  * through `Ref` and `Fn::GetAtt`.
+ *
+ * The handler reads deliveries back before it creates one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDelivery` for.
  */
 export declare class SimCfnDeliveryCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-creator.js

@@ -17,11 +17,16 @@ const actedOnProperties = new Set([
  * A delivery is the join between a source and a destination, and both have to
  * be deployed before it. A template gets that ordering from naming them
  * through `Ref` and `Fn::GetAtt`.
+ *
+ * The handler reads deliveries back before it creates one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDelivery` for.
  */
 export class SimCfnDeliveryCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery from an AWS::Logs::Delivery Resource.
@@ -35,6 +40,7 @@ export class SimCfnDeliveryCreator {
             unsimulatedReasons: deliveryUnsimulatedReasons,
         });
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliveryCreate(options?.caller);
         const created = await this.#logs.createDelivery({ input: simCfnDeliveryInput(reader) }, options);
         const delivery = this.#logs.findDelivery(created.delivery?.id ?? "");
         assertDefined(delivery, `sim CloudWatch Logs delivery for CloudFormation Resource ${resource.logicalId}`);

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-destination-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDeliveryDestination } from "../../delivery/sim-logs-delivery-destination.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliveryDestinationCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated delivery destinations from AWS::Logs::DeliveryDestination
@@ -14,6 +16,9 @@ interface SimCfnDeliveryDestinationCreatorProperties {
  * changes it replaces the Resource. Sim CloudFormation replaces a Resource
  * whose template entry changed at all, which lands on the same behaviour
  * without the destination having to say so.
+ *
+ * The handler reads the destination back before it puts one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDeliveryDestination` for.
  */
 export declare class SimCfnDeliveryDestinationCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-destination-creator.js

@@ -15,11 +15,16 @@ const actedOnProperties = new Set([
  * changes it replaces the Resource. Sim CloudFormation replaces a Resource
  * whose template entry changed at all, which lands on the same behaviour
  * without the destination having to say so.
+ *
+ * The handler reads the destination back before it puts one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDeliveryDestination` for.
  */
 export class SimCfnDeliveryDestinationCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery destination from a CloudFormation Resource.
@@ -34,6 +39,7 @@ export class SimCfnDeliveryDestinationCreator {
         });
         const name = reader.requiredString("Name");
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliveryDestinationCreate(name, options?.caller);
         await this.#logs.putDeliveryDestination({
             input: {
                 name,

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-source-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDeliverySource } from "../../delivery/sim-logs-delivery-source.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliverySourceCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated delivery sources from AWS::Logs::DeliverySource Resources.
@@ -13,6 +15,9 @@ interface SimCfnDeliverySourceCreatorProperties {
  * store, so a template hits the same refusals an SDK caller would: a
  * distribution that already has a delivery source, and a CloudFront source
  * declared in a stack outside us-east-1.
+ *
+ * The handler reads the source back before it puts one, and that read is what
+ * a CloudFormation execution Role needs `logs:GetDeliverySource` for.
  */
 export declare class SimCfnDeliverySourceCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-source-creator.js

@@ -10,11 +10,16 @@ const actedOnProperties = new Set(["Name", "ResourceArn", "LogType"]);
  * store, so a template hits the same refusals an SDK caller would: a
  * distribution that already has a delivery source, and a CloudFront source
  * declared in a stack outside us-east-1.
+ *
+ * The handler reads the source back before it puts one, and that read is what
+ * a CloudFormation execution Role needs `logs:GetDeliverySource` for.
  */
 export class SimCfnDeliverySourceCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery source from an AWS::Logs::DeliverySource Resource.
@@ -29,6 +34,7 @@ export class SimCfnDeliverySourceCreator {
         });
         const name = reader.requiredString("Name");
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliverySourceCreate(name, options?.caller);
         await this.#logs.putDeliverySource({
             input: {
                 name,

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLogsLogGroup } from "../../group/sim-logs-log-group.js";
@@ -15,6 +16,12 @@ interface SimCfnLogGroupCreatorProperties {
  * ordinary for the function to have logged first: real CloudFormation fails
  * that deploy, which is a genuine misconfiguration in an account and pure
  * noise in a test whose function ran during setup.
+ *
+ * The commands are still the ones an SDK caller would have used. The
+ * deployment's caller is authorized for `logs:CreateLogGroup` and
+ * `logs:PutRetentionPolicy`, as it is on a real deploy. A group that is
+ * already there changes what happens after that decision (the refusal is
+ * caught) and never whether one is made.
  */
 export declare class SimCfnLogGroupCreator {
     #private;
@@ -22,12 +29,12 @@ export declare class SimCfnLogGroupCreator {
     /**
      * Create a log group from an AWS::Logs::LogGroup Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimLogsLogGroup;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLogsLogGroup>;
     /**
      * Delete a log group created from an AWS::Logs::LogGroup Resource.
      *
      * The events go with it, as they do in an account.
      */
-    delete(group: SimLogsLogGroup): void;
+    delete(group: SimLogsLogGroup, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.js

@@ -1,3 +1,5 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimLogsResourceAlreadyExistsException } from "../../error/sim-logs.error.js";
 import { SimCfnLogGroupProperties } from "./sim-cfn-log-group-properties.js";
 /**
  * Creates simulated log groups from AWS::Logs::LogGroup Resources.
@@ -9,6 +11,12 @@ import { SimCfnLogGroupProperties } from "./sim-cfn-log-group-properties.js";
  * ordinary for the function to have logged first: real CloudFormation fails
  * that deploy, which is a genuine misconfiguration in an account and pure
  * noise in a test whose function ran during setup.
+ *
+ * The commands are still the ones an SDK caller would have used. The
+ * deployment's caller is authorized for `logs:CreateLogGroup` and
+ * `logs:PutRetentionPolicy`, as it is on a real deploy. A group that is
+ * already there changes what happens after that decision (the refusal is
+ * caught) and never whether one is made.
  */
 export class SimCfnLogGroupCreator {
     #logs;
@@ -18,7 +26,7 @@ export class SimCfnLogGroupCreator {
     /**
      * Create a log group from an AWS::Logs::LogGroup Resource.
      */
-    create(resource, properties) {
+    async create(resource, properties, options) {
         const logGroupProperties = new SimCfnLogGroupProperties({
             resource,
             properties,
@@ -26,8 +34,12 @@ export class SimCfnLogGroupCreator {
         const logGroupName = logGroupProperties.logGroupName();
         const retentionInDays = logGroupProperties.retentionInDays();
         logGroupProperties.recordIgnoredProperties();
-        const group = this.#logs.serviceWriter().logGroup(logGroupName);
-        group.setRetention(retentionInDays);
+        await this.#createOrAdopt(logGroupName, options);
+        if (retentionInDays !== undefined) {
+            await this.#logs.putRetentionPolicy({ input: { logGroupName, retentionInDays } }, options);
+        }
+        const group = this.#logs.findLogGroup(logGroupName);
+        assertDefined(group, `sim log group ${logGroupName} after CloudFormation creation`);
         return group;
     }
     /**
@@ -35,7 +47,24 @@ export class SimCfnLogGroupCreator {
      *
      * The events go with it, as they do in an account.
      */
-    delete(group) {
-        this.#logs.serviceWriter().deleteLogGroup(group.logGroupName);
+    async delete(group, options) {
+        await this.#logs.deleteLogGroup({ input: { logGroupName: group.logGroupName } }, options);
+    }
+    /**
+     * Make the log group, or leave the one already under that name where it is.
+     *
+     * The refusal is the one `CreateLogGroup` answers a taken name with. It is
+     * raised after the caller has been authorized. A deployment denied
+     * `logs:CreateLogGroup` therefore fails whether or not the group is there.
+     */
+    async #createOrAdopt(logGroupName, options) {
+        try {
+            await this.#logs.createLogGroup({ input: { logGroupName } }, options);
+        }
+        catch (error) {
+            if (!(error instanceof SimLogsResourceAlreadyExistsException)) {
+                throw error;
+            }
+        }
     }
 }

package/dist/service/logs/cfn/sim-logs-cfn-resource-deleter.js

@@ -17,7 +17,7 @@ export class SimLogsCfnResourceDeleter {
     async delete(resourceTypeName, resource, options) {
         switch (resourceTypeName) {
             case "LogGroup": {
-                this.#creators.logGroups.delete(created(resource));
+                await this.#creators.logGroups.delete(created(resource), options);
                 return;
             }
             case "DeliverySource": {

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.d.ts

@@ -1,8 +1,12 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimLogsAuthorizer } from "../command/authorize/sim-logs-authorizer.js";
 import type { SimLogs } from "../sim-logs.js";
 interface SimLogsCfnResourceFactoryProperties {
     readonly logs: SimLogs;
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
 }
 /**
  * CloudFormation Resource factory for simulated CloudWatch Logs resources.

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.js

@@ -1,4 +1,5 @@
 import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { SimCfnDeliveryAuthorization } from "./delivery/sim-cfn-delivery-authorization.js";
 import { SimCfnDeliveryCreator } from "./delivery/sim-cfn-delivery-creator.js";
 import { SimCfnDeliveryDestinationCreator } from "./delivery/sim-cfn-delivery-destination-creator.js";
 import { SimCfnDeliverySourceCreator } from "./delivery/sim-cfn-delivery-source-creator.js";
@@ -24,10 +25,14 @@ export class SimLogsCfnResourceFactory {
     #deliveries;
     #deleter;
     constructor(properties) {
+        const delivery = {
+            logs: properties.logs,
+            authorization: new SimCfnDeliveryAuthorization(properties),
+        };
         this.#logGroups = new SimCfnLogGroupCreator(properties);
-        this.#deliverySources = new SimCfnDeliverySourceCreator(properties);
-        this.#deliveryDestinations = new SimCfnDeliveryDestinationCreator(properties);
-        this.#deliveries = new SimCfnDeliveryCreator(properties);
+        this.#deliverySources = new SimCfnDeliverySourceCreator(delivery);
+        this.#deliveryDestinations = new SimCfnDeliveryDestinationCreator(delivery);
+        this.#deliveries = new SimCfnDeliveryCreator(delivery);
         this.#deleter = new SimLogsCfnResourceDeleter({
             logGroups: this.#logGroups,
             deliverySources: this.#deliverySources,
@@ -44,7 +49,7 @@ export class SimLogsCfnResourceFactory {
         const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "LogGroup": {
-                return this.#logGroups.create(resource, values);
+                return await this.#logGroups.create(resource, values, options);
             }
             case "DeliverySource": {
                 return await this.#deliverySources.create(resource, values, options);

package/dist/service/logs/sim-logs-commands.d.ts

@@ -1,6 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimLogsAuthorizer } from "./command/authorize/sim-logs-authorizer.js";
 import { SimLogsDeliveryCommands } from "./command/delivery/sim-logs-delivery-commands.js";
 import { SimLogsDeliveryDestinationCommands } from "./command/delivery/sim-logs-delivery-destination-commands.js";
 import { SimLogsDeliverySourceCommands } from "./command/delivery/sim-logs-delivery-source-commands.js";
@@ -45,6 +46,8 @@ export interface SimLogsProperties {
  * somewhere it is not competing for room with them.
  */
 export declare class SimLogsCommands {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly groups: SimLogsLogGroupStore;
     readonly logGroups: SimLogsLogGroupCommands;
     readonly retention: SimLogsRetentionCommands;