@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/logs/sim-logs-commands.js

@@ -30,6 +30,8 @@ import { SimLogsServiceWriter } from "./write/sim-logs-service-writer.js";
  * somewhere it is not competing for room with them.
  */
 export class SimLogsCommands {
+    authorizer;
+    accountRegionScope;
     groups;
     logGroups;
     retention;
@@ -58,6 +60,8 @@ export class SimLogsCommands {
             accountRegionScope,
             background,
         });
+        this.authorizer = authorizer;
+        this.accountRegionScope = accountRegionScope;
         this.background = background;
         this.groups = groups;
         this.fanOut = fanOut;

package/dist/service/logs/sim-logs.js

@@ -22,10 +22,15 @@ import { SimLogsDeliveryOperations } from "./sim-logs-delivery-operations.js";
 export class SimLogs extends SimLogsDeliveryOperations {
     commands;
     #sdkRouter = new SimLogsSdkCommandRouter(this);
-    #cfnFactory = new SimLogsCfnResourceFactory({ logs: this });
+    #cfnFactory;
     constructor(properties = {}) {
         super();
         this.commands = new SimLogsCommands(properties);
+        this.#cfnFactory = new SimLogsCfnResourceFactory({
+            logs: this,
+            authorizer: this.commands.authorizer,
+            accountRegionScope: this.commands.accountRegionScope,
+        });
     }
     /**
      * Find a log group by name.

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.d.ts

@@ -22,8 +22,8 @@ export declare class SimCfnS3BucketCreator {
      */
     create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimS3Bucket>;
     /**
-     * A Resource without a BucketName is named after its logical id, rather than
-     * the generated name real CloudFormation invents.
+     * A Resource without a BucketName gets the name CloudFormation generates for
+     * it, from the stack name and the logical ID.
      */
     private bucketNameForResource;
 }

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.js

@@ -1,4 +1,5 @@
 import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
+import { simCfnS3BucketGeneratedName } from "./sim-cfn-s3-bucket-generated-name.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimCfnS3BucketConfigurator } from "./sim-cfn-s3-bucket-configurator.js";
 import { SimCfnS3BucketPropertyRules } from "./sim-cfn-s3-bucket-property-rules.js";
@@ -39,14 +40,14 @@ export class SimCfnS3BucketCreator {
         return bucket;
     }
     /**
-     * A Resource without a BucketName is named after its logical id, rather than
-     * the generated name real CloudFormation invents.
+     * A Resource without a BucketName gets the name CloudFormation generates for
+     * it, from the stack name and the logical ID.
      */
     bucketNameForResource(resource, properties) {
         const bucketName = properties["BucketName"];
         if (typeof bucketName === "string") {
             return bucketName;
         }
-        return resource.logicalId.toLowerCase();
+        return simCfnS3BucketGeneratedName(resource);
     }
 }

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-generated-name.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a Bucket whose template does not name it.
+ *
+ * Sixty-three characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. It is lower
+ * cased afterwards because a bucket name is lowercase and a stack name and a
+ * logical ID are usually not. Every character left is one a bucket name allows.
+ * A logical ID is alphanumeric, a stack name adds only hyphens, and the tail is
+ * hex.
+ */
+export declare function simCfnS3BucketGeneratedName(resource: SimCfnResource): string;

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-generated-name.js

@@ -0,0 +1,22 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+/**
+ * The longest name S3 accepts, which `validateS3BucketName` applies in full.
+ */
+const maximumNameLength = 63;
+/**
+ * The name CloudFormation gives a Bucket whose template does not name it.
+ *
+ * Sixty-three characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. It is lower
+ * cased afterwards because a bucket name is lowercase and a stack name and a
+ * logical ID are usually not. Every character left is one a bucket name allows.
+ * A logical ID is alphanumeric, a stack name adds only hyphens, and the tail is
+ * hex.
+ */
+export function simCfnS3BucketGeneratedName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value.toLowerCase();
+}

package/dist/service/s3/command/authorize/sim-s3-bucket-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a Bucket.

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.d.ts

@@ -16,12 +16,21 @@ interface SimSchedulerAuthorizerProperties {
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
  * second is asked when the schedule fires, against the role rather than the
- * caller, which is why nothing about the target is consulted here.
+ * caller.
+ *
+ * A third question is asked here, about the same execution role. A schedule
+ * keeps the `Target.RoleArn` it is given and fires as it later, so the caller
+ * writing it needs `iam:PassRole` on that Role.
  */
 export declare class SimSchedulerAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimSchedulerAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Scheduler a schedule's execution role.
+     */
+    authorizePassRole(roleArn: string | undefined, options?: SimSchedulerRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a resource, named by its ARN.
      *

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { simSchedulerServicePrincipal } from "../../delivery/sim-scheduler-delivery.js";
 import { SimSchedulerAccessDeniedException } from "../../error/sim-scheduler.error.js";
 /**
  * The resource an action with no resource type authorizes against.
@@ -19,13 +21,29 @@ const noResource = "*";
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
  * second is asked when the schedule fires, against the role rather than the
- * caller, which is why nothing about the target is consulted here.
+ * caller.
+ *
+ * A third question is asked here, about the same execution role. A schedule
+ * keeps the `Target.RoleArn` it is given and fires as it later, so the caller
+ * writing it needs `iam:PassRole` on that Role.
  */
 export class SimSchedulerAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simSchedulerServicePrincipal,
+            denied: (denial) => new SimSchedulerAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand Scheduler a schedule's execution role.
+     */
+    authorizePassRole(roleArn, options) {
+        this.passRole.authorize(roleArn, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a resource, named by its ARN.

package/dist/service/scheduler/command/schedule/sim-scheduler-create-schedule.js

@@ -26,6 +26,7 @@ export class SimSchedulerCreateSchedule {
         const input = command.input;
         const requested = this.access.requested(input);
         this.access.authorize("scheduler:CreateSchedule", requested, options);
+        this.access.authorizePassRole(input, options);
         this.access.requireGroup(requested.groupName);
         if (this.schedules.find(requested.groupName, requested.name.value) !==
             undefined) {

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.d.ts

@@ -5,6 +5,7 @@ import type { SimSchedulerSchedule } from "../../schedule/sim-scheduler-schedule
 import type { SimSchedulerScheduleStore } from "../../schedule/sim-scheduler-schedule-store.js";
 import type { SimSchedulerAuthorizer } from "../authorize/sim-scheduler-authorizer.js";
 import type { SimSchedulerRequestOptions } from "../sim-scheduler-request-options.js";
+import type { SimSchedulerScheduleInput } from "./schedule.command.js";
 /**
  * Which schedule a request names, in which group.
  */
@@ -44,6 +45,13 @@ export declare class SimSchedulerScheduleAccess {
      * exist.
      */
     authorize(action: string, requested: SimSchedulerRequestedSchedule, options?: SimSchedulerRequestOptions): void;
+    /**
+     * Ensure the caller may hand Scheduler the execution role a request names.
+     *
+     * A schedule fires as its `Target.RoleArn` long after the request that wrote
+     * it, so writing one is a hand-over of that Role.
+     */
+    authorizePassRole(input: SimSchedulerScheduleInput, options?: SimSchedulerRequestOptions): void;
     /**
      * Ensure the group a request names is there, which AWS requires of every
      * request naming one.

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.js

@@ -34,6 +34,15 @@ export class SimSchedulerScheduleAccess {
     authorize(action, requested, options) {
         this.authorizer.authorizeResource(action, this.arnFor(requested), options);
     }
+    /**
+     * Ensure the caller may hand Scheduler the execution role a request names.
+     *
+     * A schedule fires as its `Target.RoleArn` long after the request that wrote
+     * it, so writing one is a hand-over of that Role.
+     */
+    authorizePassRole(input, options) {
+        this.authorizer.authorizePassRole(input.Target?.RoleArn, options);
+    }
     /**
      * Ensure the group a request names is there, which AWS requires of every
      * request naming one.

package/dist/service/scheduler/command/schedule/sim-scheduler-update-schedule.js

@@ -27,6 +27,7 @@ export class SimSchedulerUpdateSchedule {
         const input = command.input;
         const existing = this.access.require("scheduler:UpdateSchedule", input, options);
         const requested = this.access.requested(input);
+        this.access.authorizePassRole(input, options);
         // The creation date survives a replacement, because AWS does not consider
         // an updated schedule to be a new one.
         const schedule = this.writer.write(input, requested, existing.creationDate);

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-generated-name.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a secret whose template does not name it.
+ *
+ * Five hundred and twelve characters is long enough that a stack name and a
+ * logical ID rarely reach it, so `SimCfnGeneratedResourceName` seldom has to
+ * trim one. The case is left alone, since Secrets Manager keeps a name as it
+ * was given, and every character a stack name or a logical ID is made of is one
+ * a secret name allows.
+ *
+ * Real Secrets Manager appends six random characters of its own to a secret's
+ * ARN whatever the name is. A template reading the ARN back reads it off the
+ * Resource either way.
+ */
+export declare function simCfnSecretsManagerGeneratedName(resource: SimCfnResource): string;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-generated-name.js

@@ -0,0 +1,22 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { maximumSimSecretsManagerNameLength } from "../../secret/sim-secrets-manager-secret-name.js";
+/**
+ * The name CloudFormation gives a secret whose template does not name it.
+ *
+ * Five hundred and twelve characters is long enough that a stack name and a
+ * logical ID rarely reach it, so `SimCfnGeneratedResourceName` seldom has to
+ * trim one. The case is left alone, since Secrets Manager keeps a name as it
+ * was given, and every character a stack name or a logical ID is made of is one
+ * a secret name allows.
+ *
+ * Real Secrets Manager appends six random characters of its own to a secret's
+ * ARN whatever the name is. A template reading the ARN back reads it off the
+ * Resource either way.
+ */
+export function simCfnSecretsManagerGeneratedName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumSimSecretsManagerNameLength,
+    }).value;
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-properties.d.ts

@@ -10,8 +10,8 @@ interface SimCfnSecretsManagerSecretPropertiesProperties {
  * the secret creator needs.
  *
  * Keeping the property-shape rules here leaves the creator to do nothing but
- * call CreateSecret, and puts the one rule worth stating in a single place:
- * a template supplies a value or asks for one to be generated, never both.
+ * call CreateSecret. Which of the two value properties wins is its own
+ * decision, and lives in `simCfnSecretsManagerSecretValue`.
  */
 export declare class SimCfnSecretsManagerSecretProperties {
     private readonly resource;
@@ -22,11 +22,8 @@ export declare class SimCfnSecretsManagerSecretProperties {
     /**
      * The secret name.
      *
-     * An unnamed secret is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation prefixes the stack
-     * name and appends its own random characters, so a template relying on the
-     * exact generated name would be relying on something it cannot predict
-     * anyway.
+     * An unnamed secret is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name(): string;
     /**
@@ -43,11 +40,8 @@ export declare class SimCfnSecretsManagerSecretProperties {
     tags(): readonly SimSecretsManagerTag[] | undefined;
     /**
      * The value the secret's first version holds.
-     *
-     * Either the template supplies one or it asks for one to be generated.
      */
     secretString(): string;
     private string;
-    private propertyError;
 }
 export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-properties.js

@@ -1,12 +1,14 @@
 import { SimCfnSecretsManagerPropertyParser } from "../sim-cfn-secrets-manager-property-parser.js";
 import { SimCfnSecretsManagerGenerateSecretStringParser } from "./sim-cfn-secrets-manager-generate-secret-string-parser.js";
+import { simCfnSecretsManagerGeneratedName } from "./sim-cfn-secrets-manager-generated-name.js";
+import { simCfnSecretsManagerSecretValue } from "./sim-cfn-secrets-manager-secret-value.js";
 /**
  * Reads AWS::SecretsManager::Secret CloudFormation properties into the shape
  * the secret creator needs.
  *
  * Keeping the property-shape rules here leaves the creator to do nothing but
- * call CreateSecret, and puts the one rule worth stating in a single place:
- * a template supplies a value or asks for one to be generated, never both.
+ * call CreateSecret. Which of the two value properties wins is its own
+ * decision, and lives in `simCfnSecretsManagerSecretValue`.
  */
 export class SimCfnSecretsManagerSecretProperties {
     resource;
@@ -20,14 +22,12 @@ export class SimCfnSecretsManagerSecretProperties {
     /**
      * The secret name.
      *
-     * An unnamed secret is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation prefixes the stack
-     * name and appends its own random characters, so a template relying on the
-     * exact generated name would be relying on something it cannot predict
-     * anyway.
+     * An unnamed secret is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name() {
-        return (this.string(this.properties["Name"], "Name") ?? this.resource.logicalId);
+        return (this.string(this.properties["Name"], "Name") ??
+            simCfnSecretsManagerGeneratedName(this.resource));
     }
     /**
      * The secret Description.
@@ -49,33 +49,15 @@ export class SimCfnSecretsManagerSecretProperties {
     }
     /**
      * The value the secret's first version holds.
-     *
-     * Either the template supplies one or it asks for one to be generated.
      */
     secretString() {
-        const supplied = this.string(this.properties["SecretString"], "SecretString");
-        const generated = this.generateParser.parse(this.resource, this.properties["GenerateSecretString"]);
-        if (supplied !== undefined && generated !== undefined) {
-            throw this.propertyError("SecretString and GenerateSecretString cannot both be declared: " +
-                "a secret either holds the value the template supplies or one " +
-                "Secrets Manager generates");
-        }
-        if (supplied !== undefined) {
-            return supplied;
-        }
-        if (generated !== undefined) {
-            return generated.generate();
-        }
-        throw this.propertyError("either SecretString or GenerateSecretString is required. Real " +
-            "CloudFormation creates an empty secret when both are omitted, " +
-            "which simulated Secrets Manager does not model, so it refuses the " +
-            "Resource rather than creating a secret that has no value to read");
+        return simCfnSecretsManagerSecretValue({
+            resource: this.resource,
+            supplied: this.string(this.properties["SecretString"], "SecretString"),
+            generated: this.generateParser.parse(this.resource, this.properties["GenerateSecretString"]),
+        });
     }
     string(value, name) {
         return this.propertyParser.optionalString(this.resource, value, name);
     }
-    propertyError(reason) {
-        return new Error(`Invalid AWS::SecretsManager::Secret Resource ` +
-            `${this.resource.logicalId}: ${reason}`);
-    }
 }

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-value.d.ts

@@ -0,0 +1,17 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimSecretsManagerGeneratedSecretString } from "../../secret/generate/sim-secrets-manager-generated-secret-string.js";
+interface SimCfnSecretsManagerSecretValueProperties {
+    readonly resource: SimCfnResource;
+    readonly supplied: string | undefined;
+    readonly generated: SimSecretsManagerGeneratedSecretString | undefined;
+}
+/**
+ * The value a secret's first version holds.
+ *
+ * A template supplies a value or asks for one to be generated, never both and
+ * never neither. Real CloudFormation creates an empty secret where both are
+ * omitted, which simulated Secrets Manager has no model for, and a secret with
+ * no value to read is worse to be handed than a refusal.
+ */
+export declare function simCfnSecretsManagerSecretValue(properties: SimCfnSecretsManagerSecretValueProperties): string;
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-value.js

@@ -0,0 +1,30 @@
+/**
+ * The value a secret's first version holds.
+ *
+ * A template supplies a value or asks for one to be generated, never both and
+ * never neither. Real CloudFormation creates an empty secret where both are
+ * omitted, which simulated Secrets Manager has no model for, and a secret with
+ * no value to read is worse to be handed than a refusal.
+ */
+export function simCfnSecretsManagerSecretValue(properties) {
+    const { resource, supplied, generated } = properties;
+    if (supplied !== undefined && generated !== undefined) {
+        throw refusal(resource, "SecretString and GenerateSecretString cannot both be declared: " +
+            "a secret either holds the value the template supplies or one " +
+            "Secrets Manager generates");
+    }
+    if (supplied !== undefined) {
+        return supplied;
+    }
+    if (generated !== undefined) {
+        return generated.generate();
+    }
+    throw refusal(resource, "either SecretString or GenerateSecretString is required. Real " +
+        "CloudFormation creates an empty secret when both are omitted, " +
+        "which simulated Secrets Manager does not model, so it refuses the " +
+        "Resource rather than creating a secret that has no value to read");
+}
+function refusal(resource, reason) {
+    return new Error(`Invalid AWS::SecretsManager::Secret Resource ` +
+        `${resource.logicalId}: ${reason}`);
+}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-name.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The longest name Secrets Manager accepts for a secret.
+ *
+ * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
+ */
+export declare const maximumSimSecretsManagerNameLength = 512;
 /**
  * The name of one simulated secret, validated as real Secrets Manager does.
  *

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-name.js

@@ -1,6 +1,11 @@
 import { SimSecretsManagerInvalidParameterException } from "../error/sim-secrets-manager.error.js";
 import { secretArnSuffixPattern } from "./sim-secrets-manager-secret-arn.js";
-const maxNameLength = 512;
+/**
+ * The longest name Secrets Manager accepts for a secret.
+ *
+ * https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
+ */
+export const maximumSimSecretsManagerNameLength = 512;
 const allowedCharacters = /^[\w+=./@-]+$/;
 /**
  * The name of one simulated secret, validated as real Secrets Manager does.
@@ -18,8 +23,8 @@ export class SimSecretsManagerSecretName {
         if (name === undefined || name === "") {
             throw new SimSecretsManagerInvalidParameterException("Name is required to create a secret");
         }
-        if (name.length > maxNameLength) {
-            throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' is longer than the ${String(maxNameLength)} characters Secrets Manager allows`);
+        if (name.length > maximumSimSecretsManagerNameLength) {
+            throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' is longer than the ${String(maximumSimSecretsManagerNameLength)} characters Secrets Manager allows`);
         }
         if (!allowedCharacters.test(name)) {
             throw new SimSecretsManagerInvalidParameterException(`Secret name '${name}' contains characters Secrets Manager does not allow: ` +

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a topic.

package/dist/service/sqs/command/authorize/sim-sqs-queue-resource-policies.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-input.js";
 import type { SimSqsQueue } from "../../queue/sim-sqs-queue.js";
 /**
  * The resource policies sim IAM should evaluate for a request against a queue.

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-generated-parameter-name.d.ts

@@ -0,0 +1,16 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a parameter whose template does not name it.
+ *
+ * How much room a name has depends on the Account and Region, since the ARN
+ * prefix comes out of the same allowance. There is enough of it that a stack
+ * name and a logical ID rarely reach the limit, so
+ * `SimCfnGeneratedResourceName` seldom has to trim one.
+ *
+ * The name carries no leading slash and so sits at the top of the hierarchy,
+ * where real CloudFormation puts a parameter it names itself. The case is left
+ * alone, since Parameter Store keeps a name as it was given, and every
+ * character a stack name or a logical ID is made of is one a parameter name
+ * allows.
+ */
+export declare function simCfnSsmGeneratedParameterName(resource: SimCfnResource): string;

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-generated-parameter-name.js

@@ -0,0 +1,23 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { maximumSimSsmParameterNameLength } from "../../parameter/sim-ssm-parameter-arn.js";
+/**
+ * The name CloudFormation gives a parameter whose template does not name it.
+ *
+ * How much room a name has depends on the Account and Region, since the ARN
+ * prefix comes out of the same allowance. There is enough of it that a stack
+ * name and a logical ID rarely reach the limit, so
+ * `SimCfnGeneratedResourceName` seldom has to trim one.
+ *
+ * The name carries no leading slash and so sits at the top of the hierarchy,
+ * where real CloudFormation puts a parameter it names itself. The case is left
+ * alone, since Parameter Store keeps a name as it was given, and every
+ * character a stack name or a logical ID is made of is one a parameter name
+ * allows.
+ */
+export function simCfnSsmGeneratedParameterName(resource) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumSimSsmParameterNameLength(resource.accountRegionScope),
+    }).value;
+}

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.d.ts

@@ -23,10 +23,8 @@ export declare class SimCfnSsmParameterProperties {
     /**
      * The parameter name.
      *
-     * An unnamed parameter is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation generates a name from
-     * the stack name and its own random characters, which a template could not
-     * predict anyway.
+     * An unnamed parameter is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name(): string;
     /**

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.js

@@ -1,3 +1,4 @@
+import { simCfnSsmGeneratedParameterName } from "./sim-cfn-ssm-generated-parameter-name.js";
 /**
  * Reads AWS::SSM::Parameter CloudFormation properties into the shape
  * PutParameter takes.
@@ -19,13 +20,12 @@ export class SimCfnSsmParameterProperties {
     /**
      * The parameter name.
      *
-     * An unnamed parameter is named after its logical ID, as sim CloudFormation
-     * names other unnamed resources. Real CloudFormation generates a name from
-     * the stack name and its own random characters, which a template could not
-     * predict anyway.
+     * An unnamed parameter is named after the stack and the logical ID, as
+     * CloudFormation names one.
      */
     name() {
-        return (this.string(this.properties["Name"], "Name") ?? this.resource.logicalId);
+        return (this.string(this.properties["Name"], "Name") ??
+            simCfnSsmGeneratedParameterName(this.resource));
     }
     /**
      * The parameter type.

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -12,10 +12,10 @@ export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
  * The service Parameter Store's KMS calls are made through, as
  * `kms:ViaService` names it.
  *
- * Supplying it is what lets a caller read a `SecureString` under the
- * `aws/ssm` managed key with no KMS permission of its own: that key's policy
- * admits the Account's principals only when the request reached KMS through
- * Systems Manager.
+ * The `aws/ssm` managed key's policy admits the Account's principals only when
+ * the request reached KMS through Systems Manager, so a request that does not
+ * supply this reaches the key at all only where the key policy names the
+ * caller.
  */
 export declare const ssmKmsViaService = "ssm";
 /**
@@ -35,6 +35,7 @@ export interface SimSsmKmsCrypto {
     }, options?: {
         caller?: SimAwsCaller | undefined;
         viaService?: string | undefined;
+        withCallerPermissions?: boolean | undefined;
     }): Promise<{
         CiphertextBlob?: Uint8Array | undefined;
         KeyId?: string | undefined;
@@ -47,6 +48,7 @@ export interface SimSsmKmsCrypto {
     }, options?: {
         caller?: SimAwsCaller | undefined;
         viaService?: string | undefined;
+        withCallerPermissions?: boolean | undefined;
     }): Promise<{
         Plaintext?: Uint8Array | undefined;
         KeyId?: string | undefined;

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js

@@ -11,9 +11,9 @@ export const ssmDefaultKeyAlias = "alias/aws/ssm";
  * The service Parameter Store's KMS calls are made through, as
  * `kms:ViaService` names it.
  *
- * Supplying it is what lets a caller read a `SecureString` under the
- * `aws/ssm` managed key with no KMS permission of its own: that key's policy
- * admits the Account's principals only when the request reached KMS through
- * Systems Manager.
+ * The `aws/ssm` managed key's policy admits the Account's principals only when
+ * the request reached KMS through Systems Manager, so a request that does not
+ * supply this reaches the key at all only where the key policy names the
+ * caller.
  */
 export const ssmKmsViaService = "ssm";