@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/ecr/sim-ecr.d.ts

@@ -1,9 +1,11 @@
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import type { SimEcrRepository } from "./repository/sim-ecr-repository.js";
 interface SimEcrProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly registry?: SimEcrRegistry;
 }
 /**
@@ -19,6 +21,11 @@ interface SimEcrProperties {
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export declare class SimEcr {
     private readonly repositories;

package/dist/service/ecr/sim-ecr.js

@@ -1,4 +1,6 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
+import { SimEcrAuthorizer } from "./authorize/sim-ecr-authorizer.js";
 import { SimEcrCfnResourceFactory } from "./cfn/sim-ecr-cfn-resource-factory.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import { SimEcrRepositoryAddress } from "./repository/sim-ecr-repository-address.js";
@@ -16,15 +18,25 @@ import { SimEcrRepositoryStore } from "./repository/sim-ecr-repository-store.js"
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export class SimEcr {
     repositories;
-    cfnFactory = new SimEcrCfnResourceFactory({ ecr: this });
+    cfnFactory;
     constructor(properties = {}) {
         const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), registry = new SimEcrRegistry(), } = properties;
-        this.repositories = new SimEcrRepositoryStore({
-            address: new SimEcrRepositoryAddress(accountRegionScope),
-            registry,
+        const address = new SimEcrRepositoryAddress(accountRegionScope);
+        this.repositories = new SimEcrRepositoryStore({ address, registry });
+        this.cfnFactory = new SimEcrCfnResourceFactory({
+            ecr: this,
+            authorizer: new SimEcrAuthorizer({
+                iam: simIamInRegion(properties.iam, accountRegionScope.regionName),
+                address,
+            }),
         });
     }
     /**

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.d.ts

@@ -18,11 +18,23 @@ interface SimEcsAuthorizerProperties {
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export declare class SimEcsAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEcsAuthorizerProperties);
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEcsRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.
      *

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.js

@@ -1,5 +1,7 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
 import { SimEcsAccessDeniedException } from "../../error/sim-ecs.error.js";
+import { simEcsTasksServicePrincipal } from "../../sim-ecs-service-principal.js";
 /**
  * The resource an ECS action with no resource type authorizes against.
  *
@@ -24,12 +26,31 @@ const noResource = "*";
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export class SimEcsAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEcsTasksServicePrincipal,
+            denied: (denial) => new SimEcsAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.

package/dist/service/ecs/command/register-task-definition/register-task-definition.handler.js

@@ -47,6 +47,7 @@ export class RegisterTaskDefinitionCommandHandler extends SimEcsCommandHandler {
         const settings = new SimEcsTaskDefinitionSettings(command.input);
         await this.sequence();
         const caller = this.authorizer.authorizeAnyResource("ecs:RegisterTaskDefinition", options);
+        this.authorizer.authorizePassRole([settings.taskRoleArn, settings.executionRoleArn], options);
         const familyRevisions = this.taskDefinitions.family(family);
         const revision = familyRevisions.nextRevisionNumber();
         const taskDefinition = new SimEcsTaskDefinition({

package/dist/service/ecs/sim-ecs-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export declare const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/ecs/sim-ecs-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.d.ts

@@ -16,6 +16,11 @@ interface SimEventBridgeAuthorizerProperties {
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -24,7 +29,14 @@ interface SimEventBridgeAuthorizerProperties {
 export declare class SimEventBridgeAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEventBridgeAuthorizerProperties);
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.
      *

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { simEventBridgeServicePrincipal } from "../../delivery/sim-event-bridge-delivery.js";
 import { SimEventBridgeAccessDeniedException } from "../../error/sim-event-bridge.error.js";
 /**
  * The resource an action with no resource type authorizes against.
@@ -20,6 +22,11 @@ const noResource = "*";
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -28,8 +35,22 @@ const noResource = "*";
 export class SimEventBridgeAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEventBridgeServicePrincipal,
+            denied: (denial) => new SimEventBridgeAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.d.ts

@@ -19,6 +19,12 @@ interface SimEventBridgeRuleAccessProperties {
     readonly authorizer: SimEventBridgeAuthorizer;
     readonly accountRegionScope: SimAwsAccountRegionScope;
 }
+/**
+ * The part of a target that names a Role.
+ */
+interface SimEventBridgeTargetRole {
+    readonly RoleArn?: string | undefined;
+}
 interface SimEventBridgeRuleRequest {
     readonly Name?: string | undefined;
     readonly EventBusName?: string | undefined;
@@ -48,6 +54,13 @@ export declare class SimEventBridgeRuleAccess {
      * Ensure the caller may perform an action on a rule, which need not exist.
      */
     authorize(action: string, requested: SimEventBridgeRequestedRule, options?: SimEventBridgeRequestOptions): void;
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets: readonly SimEventBridgeTargetRole[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.js

@@ -37,6 +37,15 @@ export class SimEventBridgeRuleAccess {
     authorize(action, requested, options) {
         this.authorizer.authorizeBus(action, this.arnFor(requested), options);
     }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets, options) {
+        this.authorizer.authorizePassRole(targets.map((target) => target.RoleArn), options);
+    }
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/target/sim-event-bridge-put-targets.js

@@ -33,6 +33,7 @@ export class SimEventBridgePutTargets {
         for (const target of requested) {
             refuseUnsimulatedTargetInput(target);
         }
+        this.access.authorizePassRole(requested, options);
         const added = requested.map((target) => SimEventTarget.of(target));
         refuseRepeatedTargetIds(added);
         const busName = rule.busName.value;

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.d.ts

@@ -11,10 +11,22 @@ interface SimFirehoseAuthorizerProperties {
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export declare class SimFirehoseAuthorizer {
     private readonly iam;
+    private readonly passRole;
     constructor(properties: SimFirehoseAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], caller?: SimAwsCaller): void;
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its
      * ARN.

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simFirehoseServicePrincipal } from "../../sim-firehose-service-principal.js";
 /**
  * Applies simulated IAM authorization to Firehose requests.
  *
@@ -6,11 +8,29 @@ import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export class SimFirehoseAuthorizer {
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simFirehoseServicePrincipal,
+        });
+    }
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns, caller) {
+        this.passRole.authorizeAll(roleArns, caller);
     }
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.d.ts

@@ -38,6 +38,10 @@ export declare class SimFirehoseDeliveryStreamAccess {
      * stream.
      */
     authorizeAny(action: string, options?: SimFirehoseRequestOptions): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimFirehoseRequestOptions): void;
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.js

@@ -37,6 +37,12 @@ export class SimFirehoseDeliveryStreamAccess {
     authorizeAny(action, options) {
         return this.authorizer.authorizeAnyDeliveryStream(action, options?.caller);
     }
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns, options) {
+        this.authorizer.authorizePassRole(roleArns, options?.caller);
+    }
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/stream/sim-firehose-create-delivery-stream.js

@@ -44,11 +44,13 @@ export class SimFirehoseCreateDeliveryStream {
         this.requireNameFree(name);
         const createdAt = this.background.now();
         const source = simFirehoseSourceOf(input, this.scope, createdAt);
+        const destination = simFirehoseDestinationOf(input);
+        this.access.authorizePassRole([destination.roleArn, source.roleArn], options);
         const arn = simFirehoseDeliveryStreamArn(this.scope, name);
         const deliveryStream = new SimFirehoseDeliveryStream({
             name,
             arn,
-            destination: simFirehoseDestinationOf(input),
+            destination,
             source,
             createdAt,
         });

package/dist/service/firehose/sim-firehose-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export declare const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/sim-firehose-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/source/sim-firehose-source.d.ts

@@ -14,6 +14,11 @@ export type SimFirehoseDeliveryStreamType = "DirectPut" | "KinesisStreamAsSource
 export declare class SimFirehoseDirectPutSource {
     readonly kind: "direct-put";
     readonly deliveryStreamType: "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    readonly roleArn: undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/firehose/source/sim-firehose-source.js

@@ -5,6 +5,11 @@ import { SimFirehoseInvalidArgumentException } from "../error/sim-firehose.error
 export class SimFirehoseDirectPutSource {
     kind = "direct-put";
     deliveryStreamType = "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    roleArn = undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/glue/cfn/database/sim-cfn-glue-database-properties.js

@@ -1,6 +1,7 @@
 import { glueCfnPropertyError } from "../sim-cfn-glue-property-error.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueDatabaseRules } from "./sim-cfn-glue-database-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Database";
 /**
  * Reads AWS::Glue::Database CloudFormation properties.
@@ -28,10 +29,9 @@ export class SimCfnGlueDatabaseProperties {
      */
     databaseName() {
         const values = this.#values;
-        const stackName = this.#resource.stackName ?? "stack";
         return (values.optionalString(this.#input()["Name"], "DatabaseInput.Name") ??
             values.optionalString(this.#properties["DatabaseName"], "DatabaseName") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+            simCfnGlueGeneratedName(this.#resource));
     }
     /** What the database is created with, beyond its name. */
     databaseInput() {

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export declare function simCfnGlueGeneratedName(resource: SimCfnResource): string;

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.js

@@ -0,0 +1,25 @@
+import { SimCfnGeneratedResourceName } from "../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { simGlueFolded } from "../database/sim-glue-catalog-name.js";
+/**
+ * The longest name the Data Catalog accepts for a database or a table.
+ *
+ * Glue states the limit in UTF-8 bytes and `SimCfnGeneratedResourceName` trims
+ * by character. The two come to the same thing here. A logical ID is
+ * alphanumeric, a stack name adds only hyphens, and the tail is hex.
+ */
+const maximumNameLength = 255;
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export function simCfnGlueGeneratedName(resource) {
+    return simGlueFolded(new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value);
+}

package/dist/service/glue/cfn/table/sim-cfn-glue-table-properties.js

@@ -3,6 +3,7 @@ import { SimCfnGlueRecord } from "../sim-cfn-glue-record.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueTableInputReader } from "./sim-cfn-glue-table-input.js";
 import { simCfnGlueTableIgnored } from "./sim-cfn-glue-table-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Table";
 /**
  * Reads AWS::Glue::Table CloudFormation properties.
@@ -32,9 +33,7 @@ export class SimCfnGlueTableProperties {
      * since Glue names are lowercase for Hive compatibility.
      */
     tableName() {
-        const stackName = this.#resource.stackName ?? "stack";
-        return (this.#input().string("Name") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+        return (this.#input().string("Name") ?? simCfnGlueGeneratedName(this.#resource));
     }
     /** What the table is created with, beyond its name and its database. */
     tableInput() {

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -6,6 +6,12 @@ interface SimIamAllowSidesProperties {
      * Defaults to the resource side, for callers with no reason to distinguish.
      */
     readonly resourceDirect?: boolean | undefined;
+    /**
+     * Whether a resource-policy Allow named the caller, rather than admitting it
+     * as one of a wider set through a wildcard principal. Defaults to the
+     * resource side in the same way.
+     */
+    readonly resourceNamesCaller?: boolean | undefined;
 }
 /**
  * Which sides of a policy evaluation produced a matching Allow.
@@ -19,6 +25,7 @@ export declare class SimIamAllowSides {
     private readonly identityAllowed;
     private readonly resourceAllowed;
     private readonly resourceDirectAllowed;
+    private readonly resourceNamesCallerAllowed;
     constructor(properties: SimIamAllowSidesProperties);
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +36,8 @@ export declare class SimIamAllowSides {
      */
     get resource(): boolean;
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect(): boolean;
     /**
@@ -38,6 +45,11 @@ export declare class SimIamAllowSides {
      * its Account, which grants nothing on its own.
      */
     get resourceDelegated(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller(): boolean;
 }
 /**
  * Which sides of an authorization must allow a request for it to be allowed.
@@ -97,6 +109,25 @@ export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamA
      */
     isSatisfiedBy(allows: SimIamAllowSides): boolean;
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service. That is the
+ * difference between a key policy naming a Role and the aws/ssm key policy,
+ * which admits the Account's principals reaching KMS through Parameter Store
+ * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
+ * SecureString.
+ */
+export declare class SimIamCallerPermissionRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
 /**
  * Every applicable rule at once.
  *

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -10,11 +10,14 @@ export class SimIamAllowSides {
     identityAllowed;
     resourceAllowed;
     resourceDirectAllowed;
+    resourceNamesCallerAllowed;
     constructor(properties) {
         this.identityAllowed = properties.identity;
         this.resourceAllowed = properties.resource;
         this.resourceDirectAllowed =
             properties.resourceDirect ?? properties.resource;
+        this.resourceNamesCallerAllowed =
+            properties.resourceNamesCaller ?? properties.resource;
     }
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +32,8 @@ export class SimIamAllowSides {
         return this.resourceAllowed;
     }
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect() {
         return this.resourceDirectAllowed;
@@ -42,6 +45,13 @@ export class SimIamAllowSides {
     get resourceDelegated() {
         return this.resourceAllowed && !this.resourceDirectAllowed;
     }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller() {
+        return this.resourceNamesCallerAllowed;
+    }
 }
 /**
  * The same-Account rule: an Allow from either side is enough.
@@ -104,6 +114,27 @@ export class SimIamMandatoryResourcePolicyRequirement {
         return allows.resourceDelegated && allows.identity;
     }
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service. That is the
+ * difference between a key policy naming a Role and the aws/ssm key policy,
+ * which admits the Account's principals reaching KMS through Parameter Store
+ * and still leaves a Role holding only ssm:GetParameter unable to decrypt a
+ * SecureString.
+ */
+export class SimIamCallerPermissionRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows) {
+        return allows.resourceNamesCaller || allows.identity;
+    }
+}
 /**
  * Every applicable rule at once.
  *