@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -16,12 +16,13 @@ export declare class SimIamAllowStatements {
     private readonly resourceStatements;
     private readonly trustStatements;
     private readonly delegatedStatements;
+    private readonly namingStatements;
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -13,12 +13,13 @@ export class SimIamAllowStatements {
     resourceStatements = [];
     trustStatements = [];
     delegatedStatements = [];
+    namingStatements = [];
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy, statement, principal) {
         if (policy.sourceType === "trust") {
@@ -27,6 +28,9 @@ export class SimIamAllowStatements {
         if (principal.isAccountDelegation) {
             this.delegatedStatements.push(statement);
         }
+        if (principal.namesCaller) {
+            this.namingStatements.push(statement);
+        }
         this.sideStatements(policy).push(statement);
     }
     /**
@@ -58,10 +62,12 @@ export class SimIamAllowStatements {
      */
     get sides() {
         const delegated = new Set(this.delegatedStatements);
+        const naming = new Set(this.namingStatements);
         return new SimIamAllowSides({
             identity: this.identityStatements.length > 0,
             resource: this.resourceStatements.length > 0,
             resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
+            resourceNamesCaller: this.resourceStatements.some((statement) => naming.has(statement)),
         });
     }
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -1,16 +1,25 @@
 import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * What an authorization request says about the rules it is subject to, beyond
+ * the caller and the policies themselves.
+ */
+export interface SimIamAllowRequirementInput {
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+    readonly withCallerPermissions?: boolean | undefined;
+}
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export declare class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+    resolve(callerAccount: SimIamCallerAccount, input: SimIamAllowRequirementInput): SimIamAllowRequirement;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -1,23 +1,27 @@
-import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+import { SimIamCallerPermissionRequirement, SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount, requiresResourcePolicyAllow) {
-        if (requiresResourcePolicyAllow !== true) {
-            return callerAccount.allowRequirement;
-        }
-        return new SimIamEveryAllowRequirement([
+    resolve(callerAccount, input) {
+        const requirements = [
             callerAccount.allowRequirement,
-            new SimIamMandatoryResourcePolicyRequirement(),
-        ]);
+        ];
+        if (input.requiresResourcePolicyAllow === true) {
+            requirements.push(new SimIamMandatoryResourcePolicyRequirement());
+        }
+        if (input.withCallerPermissions === true) {
+            requirements.push(new SimIamCallerPermissionRequirement());
+        }
+        return new SimIamEveryAllowRequirement(requirements);
     }
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,5 +1,6 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
@@ -23,13 +24,18 @@ export interface SimIamAuthZCallerContextBuilderProperties {
      * The caller this simulation attributes an unattributed request to.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where an unattributed request looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * A request that omits a caller is decided as the simulation's default caller,
- * and as the Account root where the simulation named none. An explicit
- * anonymous caller falls back to neither.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export declare class SimIamAuthZCallerContextBuilder {
     private readonly callerResolver;

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -2,9 +2,10 @@ import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolv
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * A request that omits a caller is decided as the simulation's default caller,
- * and as the Account root where the simulation named none. An explicit
- * anonymous caller falls back to neither.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export class SimIamAuthZCallerContextBuilder {
     callerResolver;
@@ -17,6 +18,7 @@ export class SimIamAuthZCallerContextBuilder {
         this.callerResolver = new SimAwsCallerResolver({
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
         });
     }
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,81 +1,15 @@
 import type { SimArn } from "../../../aws/arn.js";
-import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
-import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicy } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
-import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
-import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthorizationInput } from "./sim-iam-auth-z-input.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
 import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
-export interface SimIamResourcePolicyInput {
-    readonly document: SimIamPolicyDocument;
-    readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
-    readonly policyName?: string | undefined;
-    readonly resourceArn?: string | undefined;
-}
-/**
- * Entry-point input for sim IAM allow/deny authorization.
- */
-export interface SimIamAuthorizationInput {
-    readonly action: string;
-    readonly resource: string;
-    /**
-     * The Region the request was made in, which sim IAM derives
-     * `aws:RequestedRegion` from.
-     *
-     * A simulated service supplies its own Region. A request reaching one
-     * through its command handlers therefore carries it, with the caller saying
-     * nothing. IAM itself belongs to an Account and has no Region to fall back
-     * on. A request arriving without one leaves the key out of the condition
-     * context, and a statement conditioned on it matches nothing.
-     */
-    readonly region?: AwsRegionName | undefined;
-    /**
-     * Condition values known by the service handling the simulated request, such
-     * as S3 object tags. Sim IAM automatically supplies global condition values
-     * that it can derive itself, such as AWS:PrincipalArn.
-     *
-     * Context-key names are matched case-insensitively by the condition matcher,
-     * while string values remain case-sensitive. IAM-derived values take
-     * precedence over supplied values for equivalent keys.
-     */
-    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
-    /**
-     * Condition values the service can only supply once IAM has resolved the
-     * caller, such as the Account a KMS request came from.
-     *
-     * These are combined with the values supplied directly, and IAM-derived
-     * values still take precedence over both.
-     */
-    readonly callerConditions?: SimIamCallerConditionSource | undefined;
-    /**
-     * Simulated request caller.
-     *
-     * If credentials are supplied, they are authenticated before policy
-     * evaluation. If omitted, authorization defaults to the Account root.
-     */
-    readonly caller?: SimAwsCaller | undefined;
-    /**
-     * Resource policies supplied by the service that owns the target resource.
-     *
-     * Resource policies are not loaded from IAM's managed-policy store. They are
-     * supplied by the target service, such as an S3 Bucket policy or other
-     * service-level resource policy.
-     */
-    readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
-    /**
-     * Whether the resource's own policy must allow the request.
-     *
-     * Off by default, which is the ordinary AWS rule: a resource with no policy
-     * leaves the decision to the caller's identity policies. A service sets it
-     * for a resource whose policy is mandatory and is the root of trust for
-     * reaching it, which in AWS means a KMS key policy.
-     */
-    readonly requiresResourcePolicyAllow?: boolean | undefined;
-}
 interface SimIamAuthZContextBuilderProperties {
     /**
      * The Account whose IAM is evaluating the request.
@@ -86,6 +20,10 @@ interface SimIamAuthZContextBuilderProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation, for the identity side
      * of a cross-Account request.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -47,6 +47,7 @@ export class SimIamAuthZContextBuilder {
             accountRootPrincipal: makeSimAwsAccountRootPrincipal(properties.accountId),
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
         });
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
             policies: properties.policies,
@@ -75,7 +76,7 @@ export class SimIamAuthZContextBuilder {
             ],
             resourcePolicies: this.resourcePolicySources(input),
             serviceControlPolicies: this.scpSourceBuilder.build(callerContext.caller),
-            allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
+            allowRequirement: this.allowRequirement.resolve(callerAccount, input),
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.d.ts

@@ -0,0 +1,87 @@
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
+import type { SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+export interface SimIamResourcePolicyInput {
+    readonly document: SimIamPolicyDocument;
+    readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
+    readonly policyName?: string | undefined;
+    readonly resourceArn?: string | undefined;
+}
+/**
+ * Entry-point input for sim IAM allow/deny authorization.
+ */
+export interface SimIamAuthorizationInput {
+    readonly action: string;
+    readonly resource: string;
+    /**
+     * The Region the request was made in, which sim IAM derives
+     * `aws:RequestedRegion` from.
+     *
+     * A simulated service supplies its own Region. A request reaching one
+     * through its command handlers therefore carries it, with the caller saying
+     * nothing. IAM itself belongs to an Account and has no Region to fall back
+     * on. A request arriving without one leaves the key out of the condition
+     * context, and a statement conditioned on it matches nothing.
+     */
+    readonly region?: AwsRegionName | undefined;
+    /**
+     * Condition values known by the service handling the simulated request, such
+     * as S3 object tags. Sim IAM automatically supplies global condition values
+     * that it can derive itself, such as AWS:PrincipalArn.
+     *
+     * Context-key names are matched case-insensitively by the condition matcher,
+     * while string values remain case-sensitive. IAM-derived values take
+     * precedence over supplied values for equivalent keys.
+     */
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+    /**
+     * Condition values the service can only supply once IAM has resolved the
+     * caller, such as the Account a KMS request came from.
+     *
+     * These are combined with the values supplied directly, and IAM-derived
+     * values still take precedence over both.
+     */
+    readonly callerConditions?: SimIamCallerConditionSource | undefined;
+    /**
+     * Simulated request caller.
+     *
+     * If credentials are supplied, they are authenticated before policy
+     * evaluation. If omitted, authorization falls back to the ambient caller of
+     * the run-as block the request is inside, then to the simulation's default
+     * caller, and then to the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Resource policies supplied by the service that owns the target resource.
+     *
+     * Resource policies are not loaded from IAM's managed-policy store. They are
+     * supplied by the target service, such as an S3 Bucket policy or other
+     * service-level resource policy.
+     */
+    readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
+    /**
+     * Whether the resource's own policy must allow the request.
+     *
+     * Off by default, which is the ordinary AWS rule: a resource with no policy
+     * leaves the decision to the caller's identity policies. A service sets it
+     * for a resource whose policy is mandatory and is the root of trust for
+     * reaching it, which in AWS means a KMS key policy.
+     */
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+    /**
+     * Whether the service is making this request with the caller's own
+     * permissions rather than with its own.
+     *
+     * Off by default, which is the ordinary AWS rule. Within one Account a
+     * resource policy admitting the caller is enough on its own. A service sets
+     * this where it reaches another service as the caller. A resource policy
+     * that admits whoever the request came from then grants nothing by itself,
+     * because what it admits is the service. Reading a SecureString needs
+     * kms:Decrypt for that reason, even under the aws/ssm key, whose policy
+     * admits the Account's principals reaching KMS through Parameter Store. A
+     * resource policy naming the caller still allows the request on its own.
+     */
+    readonly withCallerPermissions?: boolean | undefined;
+}

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -44,9 +44,12 @@ export declare class SimIamPolicyPrincipalMatcher {
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
-     * The wildcard matches both authenticated and anonymous requests. Other AWS
-     * forms require an ARN-based caller. Account delegation forms compare against
-     * the account ID derived by the caller resolver.
+     * The wildcard matches both authenticated and anonymous requests, and names
+     * neither. Other AWS forms require an ARN-based caller. Account delegation
+     * forms compare against the account ID derived by the caller resolver. An
+     * ARN carrying a wildcard of its own admits a set of principals without
+     * naming one, so it counts as a match on the same terms as `*`. Real IAM
+     * accepts no wildcard inside a Principal ARN at all.
      *
      * A pattern is compared against two ARNs, because an assumed-role session
      * has two. The session ARN is the caller, and the Role behind it is the
@@ -55,6 +58,11 @@ export declare class SimIamPolicyPrincipalMatcher {
      * that is not a session, so one comparison happens in that case.
      */
     private awsPatternMatches;
+    /**
+     * The kind of match an ARN principal pattern makes, by whether it names one
+     * principal or admits a set of them.
+     */
+    private arnPatternMatch;
     /**
      * Whether a principal pattern names one of the caller's ARNs.
      */

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -38,9 +38,9 @@ export class SimIamPolicyPrincipalMatcher {
             return this.valueMatches(statement.principal);
         }
         if (statement.notPrincipal !== undefined) {
-            // Excluding the caller says nothing about the Account delegating, so a
-            // NotPrincipal that leaves the caller in is a direct grant.
-            return SimIamPrincipalMatch.direct().when(!this.valueMatches(statement.notPrincipal).matched);
+            // Leaving the caller out of the exclusion admits it without naming it,
+            // in the way a wildcard principal does.
+            return SimIamPrincipalMatch.everyone().when(!this.valueMatches(statement.notPrincipal).matched);
         }
         return SimIamPrincipalMatch.none();
     }
@@ -78,9 +78,12 @@ export class SimIamPolicyPrincipalMatcher {
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
-     * The wildcard matches both authenticated and anonymous requests. Other AWS
-     * forms require an ARN-based caller. Account delegation forms compare against
-     * the account ID derived by the caller resolver.
+     * The wildcard matches both authenticated and anonymous requests, and names
+     * neither. Other AWS forms require an ARN-based caller. Account delegation
+     * forms compare against the account ID derived by the caller resolver. An
+     * ARN carrying a wildcard of its own admits a set of principals without
+     * naming one, so it counts as a match on the same terms as `*`. Real IAM
+     * accepts no wildcard inside a Principal ARN at all.
      *
      * A pattern is compared against two ARNs, because an assumed-role session
      * has two. The session ARN is the caller, and the Role behind it is the
@@ -90,7 +93,7 @@ export class SimIamPolicyPrincipalMatcher {
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
-            return SimIamPrincipalMatch.direct();
+            return SimIamPrincipalMatch.everyone();
         }
         const caller = this.context.caller;
         if (caller.arn === undefined) {
@@ -100,9 +103,18 @@ export class SimIamPolicyPrincipalMatcher {
         if (delegatedAccountId !== undefined) {
             return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return SimIamPrincipalMatch.direct().when(this.arnMatches(pattern, caller.arn) ||
+        return this.arnPatternMatch(pattern).when(this.arnMatches(pattern, caller.arn) ||
             this.arnMatches(pattern, caller.identityPolicyArn));
     }
+    /**
+     * The kind of match an ARN principal pattern makes, by whether it names one
+     * principal or admits a set of them.
+     */
+    arnPatternMatch(pattern) {
+        return pattern.includes("*") || pattern.includes("?")
+            ? SimIamPrincipalMatch.everyone()
+            : SimIamPrincipalMatch.direct();
+    }
     /**
      * Whether a principal pattern names one of the caller's ARNs.
      */

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts

@@ -1,16 +1,32 @@
 /**
  * How a resource-policy statement came to apply to the caller.
  *
- * AWS treats these two differently. A statement naming the caller's own ARN is
- * a grant to that principal. A statement naming the Account, as a bare account
- * ID or a root ARN, delegates the decision to that Account's IAM rather than
- * granting anything by itself. Most of this simulator does not yet act on the
- * difference; a KMS key policy does, because it is the whole reason the
- * default key policy does not make a key usable by everyone in the Account.
+ * AWS treats these apart. A statement naming the caller's own ARN is a grant
+ * to that principal. A statement naming the Account, as a bare account ID or a
+ * root ARN, delegates the decision to that Account's IAM and grants nothing by
+ * itself. A statement whose principal is a wildcard names nobody. It admits
+ * whoever the request came from, and a service calling with the caller's own
+ * permissions still needs IAM to allow that caller.
+ *
+ * A KMS key policy is where the difference shows. It is the whole reason the
+ * default key policy leaves a key unusable by the Account's principals until
+ * IAM allows them, and the reason the aws/ssm key leaves a SecureString
+ * unreadable to a caller holding no kms:Decrypt.
  */
 export declare class SimIamPrincipalMatch {
+    /**
+     * Whether the statement applies to the caller at all.
+     */
     readonly matched: boolean;
+    /**
+     * Whether the statement applies by way of the caller's Account.
+     */
     readonly isAccountDelegation: boolean;
+    /**
+     * Whether the statement named the caller, rather than admitting it as one
+     * of a wider set.
+     */
+    readonly namesCaller: boolean;
     private constructor();
     /**
      * The statement does not apply to this caller.
@@ -24,11 +40,16 @@ export declare class SimIamPrincipalMatch {
      * The statement applies by way of the caller's Account.
      */
     static accountDelegation(): SimIamPrincipalMatch;
+    /**
+     * The statement applies to whoever made the request, naming nobody.
+     */
+    static everyone(): SimIamPrincipalMatch;
     /**
      * The first match among alternatives, since Principal lists are an OR.
      *
-     * A direct match wins over a delegated one where both apply, because a
-     * statement naming the caller grants to the caller whatever else it says.
+     * A statement naming the caller wins over one that admits it some other
+     * way, because naming the caller grants to the caller whatever else the
+     * statement says.
      */
     static first(matches: readonly SimIamPrincipalMatch[]): SimIamPrincipalMatch;
     /**

package/dist/service/iam/authorize/match/sim-iam-principal-match.js

@@ -1,47 +1,72 @@
 /**
  * How a resource-policy statement came to apply to the caller.
  *
- * AWS treats these two differently. A statement naming the caller's own ARN is
- * a grant to that principal. A statement naming the Account, as a bare account
- * ID or a root ARN, delegates the decision to that Account's IAM rather than
- * granting anything by itself. Most of this simulator does not yet act on the
- * difference; a KMS key policy does, because it is the whole reason the
- * default key policy does not make a key usable by everyone in the Account.
+ * AWS treats these apart. A statement naming the caller's own ARN is a grant
+ * to that principal. A statement naming the Account, as a bare account ID or a
+ * root ARN, delegates the decision to that Account's IAM and grants nothing by
+ * itself. A statement whose principal is a wildcard names nobody. It admits
+ * whoever the request came from, and a service calling with the caller's own
+ * permissions still needs IAM to allow that caller.
+ *
+ * A KMS key policy is where the difference shows. It is the whole reason the
+ * default key policy leaves a key unusable by the Account's principals until
+ * IAM allows them, and the reason the aws/ssm key leaves a SecureString
+ * unreadable to a caller holding no kms:Decrypt.
  */
 export class SimIamPrincipalMatch {
+    /**
+     * Whether the statement applies to the caller at all.
+     */
     matched;
+    /**
+     * Whether the statement applies by way of the caller's Account.
+     */
     isAccountDelegation;
-    constructor(matched, isAccountDelegation) {
+    /**
+     * Whether the statement named the caller, rather than admitting it as one
+     * of a wider set.
+     */
+    namesCaller;
+    constructor(matched, isAccountDelegation, namesCaller) {
         this.matched = matched;
         this.isAccountDelegation = isAccountDelegation;
+        this.namesCaller = namesCaller;
     }
     /**
      * The statement does not apply to this caller.
      */
     static none() {
-        return new SimIamPrincipalMatch(false, false);
+        return new SimIamPrincipalMatch(false, false, false);
     }
     /**
      * The statement names this caller, or applies without naming an Account.
      */
     static direct() {
-        return new SimIamPrincipalMatch(true, false);
+        return new SimIamPrincipalMatch(true, false, true);
     }
     /**
      * The statement applies by way of the caller's Account.
      */
     static accountDelegation() {
-        return new SimIamPrincipalMatch(true, true);
+        return new SimIamPrincipalMatch(true, true, false);
+    }
+    /**
+     * The statement applies to whoever made the request, naming nobody.
+     */
+    static everyone() {
+        return new SimIamPrincipalMatch(true, false, false);
     }
     /**
      * The first match among alternatives, since Principal lists are an OR.
      *
-     * A direct match wins over a delegated one where both apply, because a
-     * statement naming the caller grants to the caller whatever else it says.
+     * A statement naming the caller wins over one that admits it some other
+     * way, because naming the caller grants to the caller whatever else the
+     * statement says.
      */
     static first(matches) {
         const matched = matches.filter((result) => result.matched);
-        return (matched.find((result) => !result.isAccountDelegation) ??
+        return (matched.find((result) => result.namesCaller) ??
+            matched.find((result) => !result.isAccountDelegation) ??
             matched[0] ??
             this.none());
     }