@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/iam/authorize/pass-role/sim-iam-pass-role-authorizer.d.ts

@@ -0,0 +1,74 @@
+import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../sim-iam-inter-service-auth-z.js";
+/**
+ * What a service needs to report a Role the caller may not pass.
+ */
+export interface SimIamPassRoleDenial {
+    readonly principal: SimAwsPrincipal;
+    readonly roleArn: string;
+    /**
+     * What else the message should say about why the request was denied, in the
+     * sense SimIamAccessDenied uses it.
+     */
+    readonly reason?: string | undefined;
+}
+interface SimIamPassRoleAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    /**
+     * The service principal the Role is being handed to, such as
+     * `lambda.amazonaws.com`. This is what `iam:PassedToService` carries.
+     */
+    readonly passedToService: string;
+    /**
+     * The error a refusal is reported as.
+     *
+     * Defaults to the shared IAM AccessDenied. A service reporting its own
+     * denials as its own error type supplies one, so a caller catching that type
+     * catches a refused Role along with everything else the service refused
+     * them.
+     */
+    readonly denied?: (denial: SimIamPassRoleDenial) => Error;
+}
+/**
+ * Authorizes handing a Role to a simulated service.
+ *
+ * A service given a Role to keep uses it under its own identity later, so
+ * being allowed to create the thing settles only half of the request. AWS asks
+ * separately whether the caller may hand that Role over, and the resource of
+ * that question is the Role. A scoped deployment role refused `iam:PassRole` is
+ * one of the commoner ways a real deployment stops.
+ *
+ * The Role need not exist. Real IAM decides a request before the service
+ * handles it, so a caller with no permission to pass a Role is refused whether
+ * or not the ARN names one.
+ */
+export declare class SimIamPassRoleAuthorizer {
+    private readonly iam;
+    private readonly passedToService;
+    private readonly denied;
+    constructor(properties: SimIamPassRoleAuthorizerProperties);
+    /**
+     * Ensure the caller may hand this Role to the service.
+     *
+     * A request naming no Role passes nothing and is left alone. That covers an
+     * optional Role, such as the one an update request omits to keep the Role
+     * already in place, and saves each call site repeating the check.
+     */
+    authorize(roleArn: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may hand every one of these Roles to the service.
+     *
+     * A Firehose delivery stream carrying a Role for its destination beside one
+     * for its source is what this is for. Each Role is its own question, and the
+     * first refusal is the one reported.
+     */
+    authorizeAll(roleArns: readonly (string | undefined)[], caller?: SimAwsCaller): void;
+}
+/**
+ * The message a service reports a refused Role with, in AWS's wording.
+ *
+ * A service reporting denials as its own error type builds its message from
+ * this, so a refused Role reads the same however it is reported.
+ */
+export declare function simIamPassRoleDenialMessage(denial: SimIamPassRoleDenial): string;
+export {};

package/dist/service/iam/authorize/pass-role/sim-iam-pass-role-authorizer.js

@@ -0,0 +1,92 @@
+import { SimIamCallerIdentifier } from "../../error/sim-iam-caller-identifier.js";
+import { SimIamAccessDenied } from "../../error/sim-iam.error.js";
+/**
+ * The IAM action a caller handing a Role to a service is authorized for.
+ */
+const passRoleAction = "iam:PassRole";
+/**
+ * The condition key naming the service the Role is being handed to.
+ */
+const passedToServiceKey = "iam:PassedToService";
+/**
+ * Authorizes handing a Role to a simulated service.
+ *
+ * A service given a Role to keep uses it under its own identity later, so
+ * being allowed to create the thing settles only half of the request. AWS asks
+ * separately whether the caller may hand that Role over, and the resource of
+ * that question is the Role. A scoped deployment role refused `iam:PassRole` is
+ * one of the commoner ways a real deployment stops.
+ *
+ * The Role need not exist. Real IAM decides a request before the service
+ * handles it, so a caller with no permission to pass a Role is refused whether
+ * or not the ARN names one.
+ */
+export class SimIamPassRoleAuthorizer {
+    iam;
+    passedToService;
+    denied;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.passedToService = properties.passedToService;
+        this.denied = properties.denied ?? accessDenied;
+    }
+    /**
+     * Ensure the caller may hand this Role to the service.
+     *
+     * A request naming no Role passes nothing and is left alone. That covers an
+     * optional Role, such as the one an update request omits to keep the Role
+     * already in place, and saves each call site repeating the check.
+     */
+    authorize(roleArn, caller) {
+        if (roleArn === undefined) {
+            return;
+        }
+        const decision = this.iam.authorize({
+            action: passRoleAction,
+            resource: roleArn,
+            conditionContext: { [passedToServiceKey]: this.passedToService },
+            caller,
+        });
+        if (decision.isDenied) {
+            throw this.denied({
+                principal: decision.caller.principal,
+                roleArn,
+                reason: decision.denialReason,
+            });
+        }
+    }
+    /**
+     * Ensure the caller may hand every one of these Roles to the service.
+     *
+     * A Firehose delivery stream carrying a Role for its destination beside one
+     * for its source is what this is for. Each Role is its own question, and the
+     * first refusal is the one reported.
+     */
+    authorizeAll(roleArns, caller) {
+        for (const roleArn of roleArns) {
+            this.authorize(roleArn, caller);
+        }
+    }
+}
+/**
+ * Report a refused Role as the shared IAM AccessDenied.
+ */
+function accessDenied(denial) {
+    return new SimIamAccessDenied({
+        principal: denial.principal,
+        reason: denial.reason,
+        action: passRoleAction,
+        resource: denial.roleArn,
+    });
+}
+/**
+ * The message a service reports a refused Role with, in AWS's wording.
+ *
+ * A service reporting denials as its own error type builds its message from
+ * this, so a refused Role reads the same however it is reported.
+ */
+export function simIamPassRoleDenialMessage(denial) {
+    const identifier = new SimIamCallerIdentifier().format(denial.principal);
+    return (`User: ${identifier} is not authorized to perform: ${passRoleAction} on ` +
+        `resource: ${denial.roleArn}`);
+}

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -2,11 +2,12 @@ import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
-import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
@@ -23,6 +24,13 @@ interface SimIamAccountAuthZProperties {
      * Left out, such a request is decided as this Account's root principal.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A run-as block says who is making the requests inside it, which outranks
+     * what the simulation holds for its unattributed requests generally.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation.
      *
@@ -43,10 +51,11 @@ interface SimIamAccountAuthZProperties {
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the simulation's default
- * caller, and to the root principal of the owning sim Account where the
- * simulation has none. An explicit anonymous caller suppresses both and is
- * evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the ambient caller of the
+ * run-as block the request is inside, then to the simulation's default caller,
+ * and to the root principal of the owning sim Account where there is neither.
+ * An explicit anonymous caller suppresses all three and is evaluated without
+ * identity policies.
  */
 export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -3,10 +3,11 @@ import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the simulation's default
- * caller, and to the root principal of the owning sim Account where the
- * simulation has none. An explicit anonymous caller suppresses both and is
- * evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the ambient caller of the
+ * run-as block the request is inside, then to the simulation's default caller,
+ * and to the root principal of the owning sim Account where there is neither.
+ * An explicit anonymous caller suppresses all three and is evaluated without
+ * identity policies.
  */
 export class SimIamAccountAuthZ {
     properties;
@@ -40,6 +41,7 @@ export class SimIamAccountAuthZ {
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
             defaultCaller: this.properties.defaultCaller,
+            ambientCaller: this.properties.ambientCaller,
             iamResolver: this.properties.iamResolver,
             scpResolver: this.properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -1,11 +1,12 @@
 import type { SimArn } from "../../aws/arn.js";
 import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
-import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAmbientCaller } from "../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
@@ -18,6 +19,7 @@ interface SimIamAuthorizerProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     readonly iamResolver?: SimIamAccountResolver | undefined;
     readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -1,4 +1,4 @@
-import { SimIamAuthZContextBuilder, } from "./context/sim-iam-auth-z-context-builder.js";
+import { SimIamAuthZContextBuilder } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 /**
  * Facade for simulated IAM authorization decisions.
@@ -18,6 +18,7 @@ export class SimIamAuthorizer {
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 /**
  * The part of an IAM authorization decision needed by service integrations.

package/dist/service/iam/authorize/sim-iam-wildcard.js

@@ -1,12 +1,48 @@
+import { BoundedMemo } from "../../../util/memo/bounded-memo.js";
+/**
+ * How many compiled patterns to keep, for each of the two case sensitivities.
+ *
+ * One realistic organization policy set produces fewer than a hundred distinct
+ * patterns, and every request evaluates the same ones again. A few thousand
+ * leaves room for many documents attached at once, and holds a few thousand
+ * small regular expressions at worst.
+ */
+const compiledPatternLimit = 2000;
+/*
+ * Wildcard patterns already turned into regular expressions, held in a store
+ * per case sensitivity so that a lookup needs no key built for it.
+ *
+ * A pattern's text and its case sensitivity decide the whole of what is
+ * compiled. An entry made while evaluating one simulation's policies is the
+ * entry another simulation would have made for itself. A compiled expression
+ * also carries nothing from one use to the next, because the flags below leave
+ * out "g" and "y", and `test` keeps a position only under those. These stores
+ * therefore last as long as the process does, and a `SimAws` that goes out of
+ * scope leaves them behind for the next one.
+ */
+const caseSensitivePatterns = new BoundedMemo(compiledPatternLimit);
+const caseInsensitivePatterns = new BoundedMemo(compiledPatternLimit);
 /**
  * Match an IAM-style wildcard pattern.
  *
  * "*" means zero or more characters and "?" means exactly one character.
  */
 export function simIamWildcardMatch(pattern, value, options) {
-    return wildcardMatch(pattern, value, options);
+    return patternRegExp(pattern, options.caseSensitive).test(value);
 }
-function wildcardMatch(pattern, value, options) {
+/**
+ * The regular expression a pattern compiles to, compiling it the first time it
+ * is asked for and reusing it afterwards.
+ */
+function patternRegExp(pattern, caseSensitive) {
+    return caseSensitive
+        ? caseSensitivePatterns.getOrCreate(pattern, () => compilePattern(pattern, "u"))
+        : caseInsensitivePatterns.getOrCreate(pattern, () => compilePattern(pattern, "iu"));
+}
+/**
+ * Turn a wildcard pattern into the regular expression that matches it.
+ */
+function compilePattern(pattern, flags) {
     const regexPattern = pattern
         .replaceAll(/[\\^$.*+?()[\]{}|]/gu, String.raw `\$&`)
         .replaceAll(String.raw `\*`, ".*")
@@ -17,6 +53,5 @@ function wildcardMatch(pattern, value, options) {
      * other regex characters are escaped above.
      */
     // oxlint-disable-next-line security/detect-non-literal-regexp
-    const regExp = new RegExp(`^${regexPattern}$`, options.caseSensitive ? "u" : "iu");
-    return regExp.test(value);
+    return new RegExp(`^${regexPattern}$`, flags);
 }

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -1,4 +1,5 @@
 import { SimCfnIamManagedPolicyAttacher } from "./sim-cfn-iam-managed-policy-attacher.js";
+import { simCfnIamPolicyGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Creates simulated IAM Managed Policies from CloudFormation Resources.
@@ -35,7 +36,7 @@ export class SimCfnIamManagedPolicyCreator {
     managedPolicyName(resource, properties) {
         const managedPolicyName = properties["ManagedPolicyName"];
         if (managedPolicyName === undefined) {
-            return resource.logicalId;
+            return simCfnIamPolicyGeneratedName(resource);
         }
         if (typeof managedPolicyName !== "string") {
             throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ManagedPolicyName must be a string`);

package/dist/service/iam/cfn/name/sim-cfn-iam-generated-name.d.ts

@@ -0,0 +1,16 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a Role or a User whose template does not name
+ * it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since IAM keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one an IAM name allows.
+ */
+export declare function simCfnIamPrincipalGeneratedName(resource: SimCfnResource): string;
+/**
+ * The name CloudFormation gives a Managed Policy whose template does not name
+ * it, under the same rules as a Role's but with twice the room.
+ */
+export declare function simCfnIamPolicyGeneratedName(resource: SimCfnResource): string;

package/dist/service/iam/cfn/name/sim-cfn-iam-generated-name.js

@@ -0,0 +1,36 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+/**
+ * The longest name IAM accepts for a Role or a User. Both take the same
+ * length.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+const maximumPrincipalNameLength = 64;
+/** The longest name IAM accepts for a Policy, twice what a Role takes. */
+const maximumPolicyNameLength = 128;
+/**
+ * The name CloudFormation gives a Role or a User whose template does not name
+ * it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since IAM keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one an IAM name allows.
+ */
+export function simCfnIamPrincipalGeneratedName(resource) {
+    return generatedName(resource, maximumPrincipalNameLength);
+}
+/**
+ * The name CloudFormation gives a Managed Policy whose template does not name
+ * it, under the same rules as a Role's but with twice the room.
+ */
+export function simCfnIamPolicyGeneratedName(resource) {
+    return generatedName(resource, maximumPolicyNameLength);
+}
+function generatedName(resource, maximumLength) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength,
+    }).value;
+}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,3 +1,5 @@
+import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
@@ -16,7 +18,7 @@ export class SimCfnIamRolePropertiesParser {
     parse(resource, properties) {
         return {
             roleName: this.optionalString(resource, properties["RoleName"], "RoleName") ??
-                resource.logicalId,
+                simCfnIamPrincipalGeneratedName(resource),
             path: this.optionalString(resource, properties["Path"], "Path"),
             description: this.optionalString(resource, properties["Description"], "Description"),
             assumeRolePolicyDocument: this.jsonObject(resource, properties["AssumeRolePolicyDocument"], "AssumeRolePolicyDocument"),
@@ -25,13 +27,12 @@ export class SimCfnIamRolePropertiesParser {
         };
     }
     optionalString(resource, value, label) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ${label} must be a string`);
-        }
-        return value;
+        return simCfnIamOptionalString({
+            resourceType: "AWS::IAM::Role",
+            resource,
+            value,
+            label,
+        });
     }
     jsonObject(resource, value, label) {
         if (typeof value !== "object" || value === null || Array.isArray(value)) {

package/dist/service/iam/cfn/sim-cfn-iam-optional-string.d.ts

@@ -0,0 +1,17 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnIamOptionalStringProperties {
+    readonly resourceType: string;
+    readonly resource: SimCfnResource;
+    readonly value: SimCfnTemplateValueRecord[string] | undefined;
+    readonly label: string;
+}
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export declare function simCfnIamOptionalString(properties: SimCfnIamOptionalStringProperties): string | undefined;
+export {};

package/dist/service/iam/cfn/sim-cfn-iam-optional-string.js

@@ -0,0 +1,17 @@
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export function simCfnIamOptionalString(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
+    }
+    return value;
+}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-properties-parser.js

@@ -1,3 +1,5 @@
+import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 const resourceType = "AWS::IAM::User";
 /**
@@ -18,7 +20,7 @@ export class SimCfnIamUserPropertiesParser {
         this.rejectGroups(resource, properties);
         return {
             userName: this.optionalString(resource, properties["UserName"], "UserName") ??
-                resource.logicalId,
+                simCfnIamPrincipalGeneratedName(resource),
             path: this.optionalString(resource, properties["Path"], "Path"),
             inlinePolicies: this.policiesParser.inlinePolicies(resource, properties),
             managedPolicyArns: this.policiesParser.managedPolicyArns(resource, properties),
@@ -68,12 +70,6 @@ export class SimCfnIamUserPropertiesParser {
         };
     }
     optionalString(resource, value, label) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value !== "string") {
-            throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
-        }
-        return value;
+        return simCfnIamOptionalString({ resourceType, resource, value, label });
     }
 }

package/dist/service/iam/command/policy/create-policy/create-policy-input-resolver.js

@@ -1,6 +1,7 @@
 import { makeSimPolicyArn } from "../../../policy/sim-iam-policy-arn.js";
 import { normalisePolicyPath } from "../../../policy/sim-iam-policy-path.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamManagedPolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * Validates CreatePolicy command input and resolves it into the policy's
  * identity (name, normalised path, and ARN).
@@ -26,6 +27,7 @@ export class CreatePolicyInputResolver {
         if (policyName === undefined || policyName.length === 0) {
             throw new Error("PolicyName is required");
         }
+        assertSimIamManagedPolicyWithinSizeLimit(command.input.PolicyDocument);
         this.policyDocValidator.validateOptional(command.input.PolicyDocument, {
             attachedTo: "Policy",
             name: policyName,

package/dist/service/iam/command/policy/put-role-policy/put-role-policy.handler.js

@@ -1,6 +1,7 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamInlinePolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * IAM PutRolePolicyCommand handler.
  *
@@ -33,6 +34,10 @@ export class PutRolePolicyCommandHandler {
             throw new Error("PolicyName is required");
         }
         const policyDocument = command.input.PolicyDocument;
+        assertSimIamInlinePolicyWithinSizeLimit(policyDocument, {
+            kind: "role",
+            name: roleName,
+        });
         this.policyDocValidator.validateRequired(policyDocument, {
             attachedTo: "Role",
             name: roleName,

package/dist/service/iam/command/policy/put-user-policy/put-user-policy.handler.js

@@ -1,6 +1,7 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamInlinePolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 import { assertDefined } from "../../../../../util/type-guard/defined.js";
 /**
  * IAM PutUserPolicyCommand handler.
@@ -29,6 +30,10 @@ export class PutUserPolicyCommandHandler {
         const policyName = command.input.PolicyName;
         assertDefined(policyName, "PutUserPolicyCommand.input.PolicyName");
         const policyDocument = command.input.PolicyDocument;
+        assertSimIamInlinePolicyWithinSizeLimit(policyDocument, {
+            kind: "user",
+            name: username,
+        });
         this.policyDocValidator.validateRequired(policyDocument, {
             attachedTo: "User",
             name: username,

package/dist/service/iam/command/role/create-role/create-role.handler.js

@@ -4,6 +4,7 @@ import { SimIamEntityAlreadyExists } from "../../../error/sim-iam.error.js";
 import { normaliseRolePath } from "../../../role/sim-iam-role-path.js";
 import { makeSimRoleArn } from "../../../role/arn/sim-iam-role-arn.js";
 import { SimIamTrustPolicyDocumentValidator } from "../../../validate/trust/sim-iam-trust-policy-document-validator.js";
+import { assertSimIamTrustPolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * IAM CreateRoleCommand handler.
  *
@@ -34,7 +35,9 @@ export class CreateRoleCommandHandler {
         if (roleName === undefined || roleName.length === 0) {
             throw new Error("RoleName is required");
         }
-        this.trustPolicyValidator.validateRequired(command.input.AssumeRolePolicyDocument);
+        const trustPolicyDocument = command.input.AssumeRolePolicyDocument;
+        assertSimIamTrustPolicyWithinSizeLimit(trustPolicyDocument, roleName);
+        this.trustPolicyValidator.validateRequired(trustPolicyDocument);
         const path = normaliseRolePath(command.input.Path);
         const arn = makeSimRoleArn({
             accountId: this.accountId,

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -84,3 +84,14 @@ export declare class SimIamMalformedPolicyDocument extends SimIamError {
     readonly name = "MalformedPolicyDocument";
     constructor(message: string);
 }
+/**
+ * Simulated IAM LimitExceeded error.
+ *
+ * IAM answers a request that would take the account past one of its quotas
+ * with this, such as a policy document longer than the limit for where it is
+ * going.
+ */
+export declare class SimIamLimitExceeded extends SimIamError {
+    readonly name = "LimitExceeded";
+    constructor(message: string);
+}

package/dist/service/iam/error/sim-iam.error.js

@@ -83,3 +83,16 @@ export class SimIamMalformedPolicyDocument extends SimIamError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated IAM LimitExceeded error.
+ *
+ * IAM answers a request that would take the account past one of its quotas
+ * with this, such as a policy document longer than the limit for where it is
+ * going.
+ */
+export class SimIamLimitExceeded extends SimIamError {
+    name = "LimitExceeded";
+    constructor(message) {
+        super(message, { httpStatusCode: 409 });
+    }
+}

package/dist/service/iam/index.d.ts

@@ -2,6 +2,7 @@ export { SimIam } from "./sim-iam.js";
 export type { SimIamConditionValue, SimIamPolicyDocument, SimIamPolicyDocumentCondition, SimIamPolicyDocumentPrincipal, SimIamPolicyDocumentStatement, } from "./policy/sim-iam-policy.js";
 export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
+export type { SimIamDeployRoleInput, SimIamDeployRolePolicy, } from "./role/sim-iam-deploy-role.js";
 export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";

package/dist/service/iam/policy/sim-iam-policy-document-of-size.d.ts

@@ -0,0 +1,18 @@
+import type { SimIamPolicyDocument } from "./sim-iam-policy.js";
+/**
+ * Build a policy document IAM would measure at exactly this many characters.
+ *
+ * A test about IAM's character limits has a size to state rather than a
+ * statement. Padding an ARN leaves a document IAM would otherwise take, so the
+ * size is the only thing the command is being asked about. The size is the one
+ * IAM counts, of the document written compactly, and a caller is free to
+ * indent what it hands over.
+ */
+export declare function simIamPolicyDocumentOfSize(characters: number): SimIamPolicyDocument;
+/**
+ * Build a Role trust policy document of exactly this many characters.
+ *
+ * A trust policy carries a Principal and no Resource, so it is padded through
+ * a Sid instead.
+ */
+export declare function simIamTrustPolicyDocumentOfSize(characters: number): SimIamPolicyDocument;