@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/cloudfront/sim-cloudfront.d.ts

@@ -6,11 +6,11 @@ import type { SimCreateDistributionCommand, SimCreateDistributionCommandOutput }
 import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "./command/create-function/create-function.command.js";
 import type { SimDeleteDistributionCommand, SimDeleteDistributionCommandOutput } from "./command/delete-distribution/delete-distribution.command.js";
 import type { SimDeleteFunctionCommand, SimDeleteFunctionCommandOutput } from "./command/delete-function/delete-function.command.js";
+import type { SimDescribeFunctionCommand, SimDescribeFunctionCommandOutput, SimGetFunctionCommand, SimGetFunctionCommandOutput, SimListFunctionsCommand, SimListFunctionsCommandOutput } from "./command/function/sim-cf-function-command.types.js";
 import type { SimGetDistributionCommand, SimGetDistributionCommandOutput } from "./command/get-distribution/get-distribution.command.js";
+import type { SimCreateInvalidationCommand, SimCreateInvalidationCommandOutput, SimGetInvalidationCommand, SimGetInvalidationCommandOutput, SimListInvalidationsCommand, SimListInvalidationsCommandOutput } from "./command/invalidation/sim-cf-invalidation-command.types.js";
 import type { SimUpdateDistributionCommand, SimUpdateDistributionCommandOutput } from "./command/update-distribution/update-distribution.command.js";
-import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "./distribution/sim-cloudfront-distribution.js";
-import type { SimCloudFrontResponseHeadersPolicy, SimCloudFrontResponseHeadersPolicyId } from "./response-headers-policy/sim-cf-response-headers-policy.js";
-import type { SimCloudFrontOriginAccessControl, SimCloudFrontOriginAccessControlId } from "./origin-access-control/sim-cf-origin-access-control.js";
+import { SimCloudFrontDistributions } from "./sim-cloudfront-distributions.js";
 import type { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-store-commands.js";
 import type { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
 import { type SimCloudFrontProperties, type SimCloudFrontRequestOptions } from "./sim-cloudfront-commands.js";
@@ -18,11 +18,8 @@ export type { SimCloudFrontProperties, SimCloudFrontRequestOptions, } from "./si
 /**
  * Simulated CloudFront. Handles SDK commands. Emulates AWS behaviour and state.
  */
-export declare class SimCloudFront {
-    private readonly distributions;
+export declare class SimCloudFront extends SimCloudFrontDistributions {
     private readonly cloudFrontFunctions;
-    private readonly responseHeadersPolicies;
-    private readonly originAccessControls;
     private readonly accountRegionScope;
     private readonly commands;
     private readonly cfnFactory;
@@ -39,14 +36,6 @@ export declare class SimCloudFront {
      * client talks to, reached from SimAws as `cloudFrontKeyValueStore()`.
      */
     keyValueStoreApi(): SimCloudFrontKeyValueStoreApi;
-    /**
-     * Get the simulated Distributions owned by this sim CloudFront service.
-     */
-    getDistributions(): ReadonlyMap<SimCloudFrontDistributionId, SimCloudFrontDistribution>;
-    /**
-     * Get a simulated CloudFront Distribution by ID.
-     */
-    getSimDistributionById(distributionId: SimCloudFrontDistributionId | string): SimCloudFrontDistribution | undefined;
     /**
      * Handle a Create Distribution Command from the SDK.
      */
@@ -64,54 +53,45 @@ export declare class SimCloudFront {
      */
     deleteDistribution(command: SimDeleteDistributionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteDistributionCommandOutput>;
     /**
-     * Handle a Create Function Command from the SDK.
+     * Handle a Create Invalidation Command from the SDK.
      */
-    createFunction(command: SimCreateFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimCreateFunctionCommandOutput>;
+    createInvalidation(command: SimCreateInvalidationCommand, options?: SimCloudFrontRequestOptions): Promise<SimCreateInvalidationCommandOutput>;
     /**
-     * Handle a Delete Function Command from the SDK.
+     * Handle a Get Invalidation Command from the SDK.
      */
-    deleteFunction(command: SimDeleteFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
+    getInvalidation(command: SimGetInvalidationCommand, options?: SimCloudFrontRequestOptions): Promise<SimGetInvalidationCommandOutput>;
     /**
-     * Get a sim CloudFront Function by ARN.
+     * Handle a List Invalidations Command from the SDK.
      */
-    getCloudFrontFunctionByArn(cloudFrontFunctionArn: SimArn): SimCloudFrontFunction | undefined;
+    listInvalidations(command: SimListInvalidationsCommand, options?: SimCloudFrontRequestOptions): Promise<SimListInvalidationsCommandOutput>;
     /**
-     * Get a sim CloudFront Function by name.
+     * Handle a Create Function Command from the SDK.
      */
-    getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
+    createFunction(command: SimCreateFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimCreateFunctionCommandOutput>;
     /**
-     * Store a simulated response headers policy.
-     *
-     * There is no CreateResponseHeadersPolicy command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands the policy over.
-     * A name another policy already holds is refused, as CloudFront refuses one.
+     * Handle a Delete Function Command from the SDK.
      */
-    addResponseHeadersPolicy(policy: SimCloudFrontResponseHeadersPolicy): void;
+    deleteFunction(command: SimDeleteFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
     /**
-     * Forget a simulated response headers policy.
+     * Handle a List Functions Command from the SDK.
      */
-    removeResponseHeadersPolicy(policyId: SimCloudFrontResponseHeadersPolicyId): void;
+    listFunctions(command: SimListFunctionsCommand, options?: SimCloudFrontRequestOptions): Promise<SimListFunctionsCommandOutput>;
     /**
-     * Get a simulated response headers policy by ID.
+     * Handle a Describe Function Command from the SDK.
      */
-    getResponseHeadersPolicyById(policyId: SimCloudFrontResponseHeadersPolicyId | string): SimCloudFrontResponseHeadersPolicy | undefined;
+    describeFunction(command: SimDescribeFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDescribeFunctionCommandOutput>;
     /**
-     * Store a simulated origin access control.
-     *
-     * There is no CreateOriginAccessControl command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands it over. A name
-     * another origin access control already holds is refused, as CloudFront
-     * refuses one.
+     * Handle a Get Function Command from the SDK.
      */
-    addOriginAccessControl(originAccessControl: SimCloudFrontOriginAccessControl): void;
+    getFunction(command: SimGetFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimGetFunctionCommandOutput>;
     /**
-     * Forget a simulated origin access control.
+     * Get a sim CloudFront Function by ARN.
      */
-    removeOriginAccessControl(originAccessControlId: SimCloudFrontOriginAccessControlId): void;
+    getCloudFrontFunctionByArn(cloudFrontFunctionArn: SimArn): SimCloudFrontFunction | undefined;
     /**
-     * Get a simulated origin access control by ID.
+     * Get a sim CloudFront Function by name.
      */
-    getOriginAccessControlById(originAccessControlId: SimCloudFrontOriginAccessControlId | string): SimCloudFrontOriginAccessControl | undefined;
+    getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/cloudfront/sim-cloudfront.js

@@ -1,32 +1,32 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimCloudFrontCloudFormationResourceFactory } from "./cfn/sim-cfn-cloudfront-resource-factory.js";
-import { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
-import { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
+import { SimCloudFrontDistributions } from "./sim-cloudfront-distributions.js";
 import { simCffNameInArn } from "./cff/sim-cff-arn.js";
 import { SimCloudFrontSdkCommandRouter } from "./sdk/sim-cloudfront-sdk-command-router.js";
 import { SimCloudFrontCommands, } from "./sim-cloudfront-commands.js";
 /**
  * Simulated CloudFront. Handles SDK commands. Emulates AWS behaviour and state.
  */
-export class SimCloudFront {
-    distributions = new Map();
+export class SimCloudFront extends SimCloudFrontDistributions {
     cloudFrontFunctions = new Map();
-    responseHeadersPolicies = new SimCloudFrontResponseHeadersPolicyRegistry();
-    originAccessControls = new SimCloudFrontOriginAccessControlRegistry();
     accountRegionScope;
     commands;
     cfnFactory = new SimCloudFrontCloudFormationResourceFactory(this);
     sdkRouter = new SimCloudFrontSdkCommandRouter(this);
     constructor(properties = {}) {
+        super(properties.cloudFrontRegistry);
         this.accountRegionScope =
             properties.accountRegionScope ?? simAwsAccountRegionScopeFactory.make();
         this.commands = new SimCloudFrontCommands({
             ...properties,
+            cloudFrontRegistry: this.cloudFrontRegistry,
             accountId: this.accountRegionScope.accountId,
             distributions: this.distributions,
             cloudFrontFunctions: this.cloudFrontFunctions,
             originAccessControls: this.originAccessControls,
             responseHeadersPolicies: this.responseHeadersPolicies,
+            cachePolicies: this.cachePolicies,
+            originRequestPolicies: this.originRequestPolicies,
         });
     }
     /**
@@ -44,18 +44,6 @@ export class SimCloudFront {
     keyValueStoreApi() {
         return this.commands.keyValueStoreApi;
     }
-    /**
-     * Get the simulated Distributions owned by this sim CloudFront service.
-     */
-    getDistributions() {
-        return this.distributions;
-    }
-    /**
-     * Get a simulated CloudFront Distribution by ID.
-     */
-    getSimDistributionById(distributionId) {
-        return this.distributions.get(distributionId);
-    }
     /**
      * Handle a Create Distribution Command from the SDK.
      */
@@ -81,74 +69,65 @@ export class SimCloudFront {
         return await this.commands.deleteDistribution(command, options);
     }
     /**
-     * Handle a Create Function Command from the SDK.
+     * Handle a Create Invalidation Command from the SDK.
      */
-    async createFunction(command, options) {
-        return await this.commands.createFunction(command, options);
+    async createInvalidation(command, options) {
+        return await this.commands.invalidations.createInvalidation(command, options);
     }
     /**
-     * Handle a Delete Function Command from the SDK.
+     * Handle a Get Invalidation Command from the SDK.
      */
-    async deleteFunction(command, options) {
-        return await this.commands.deleteFunction(command, options);
+    async getInvalidation(command, options) {
+        return await this.commands.invalidations.getInvalidation(command, options);
     }
     /**
-     * Get a sim CloudFront Function by ARN.
+     * Handle a List Invalidations Command from the SDK.
      */
-    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
-        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
-        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
+    async listInvalidations(command, options) {
+        return await this.commands.invalidations.listInvalidations(command, options);
     }
     /**
-     * Get a sim CloudFront Function by name.
+     * Handle a Create Function Command from the SDK.
      */
-    getCloudFrontFunctionByName(cloudFrontFunctionName) {
-        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
+    async createFunction(command, options) {
+        return await this.commands.functions.createFunction(command, options);
     }
     /**
-     * Store a simulated response headers policy.
-     *
-     * There is no CreateResponseHeadersPolicy command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands the policy over.
-     * A name another policy already holds is refused, as CloudFront refuses one.
+     * Handle a Delete Function Command from the SDK.
      */
-    addResponseHeadersPolicy(policy) {
-        this.responseHeadersPolicies.add(policy);
+    async deleteFunction(command, options) {
+        return await this.commands.functions.deleteFunction(command, options);
     }
     /**
-     * Forget a simulated response headers policy.
+     * Handle a List Functions Command from the SDK.
      */
-    removeResponseHeadersPolicy(policyId) {
-        this.responseHeadersPolicies.remove(policyId);
+    async listFunctions(command, options) {
+        return await this.commands.functions.listFunctions(command, options);
     }
     /**
-     * Get a simulated response headers policy by ID.
+     * Handle a Describe Function Command from the SDK.
      */
-    getResponseHeadersPolicyById(policyId) {
-        return this.responseHeadersPolicies.byId(policyId);
+    async describeFunction(command, options) {
+        return await this.commands.functions.describeFunction(command, options);
     }
     /**
-     * Store a simulated origin access control.
-     *
-     * There is no CreateOriginAccessControl command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands it over. A name
-     * another origin access control already holds is refused, as CloudFront
-     * refuses one.
+     * Handle a Get Function Command from the SDK.
      */
-    addOriginAccessControl(originAccessControl) {
-        this.originAccessControls.add(originAccessControl);
+    async getFunction(command, options) {
+        return await this.commands.functions.getFunction(command, options);
     }
     /**
-     * Forget a simulated origin access control.
+     * Get a sim CloudFront Function by ARN.
      */
-    removeOriginAccessControl(originAccessControlId) {
-        this.originAccessControls.remove(originAccessControlId);
+    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
+        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
+        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
     }
     /**
-     * Get a simulated origin access control by ID.
+     * Get a sim CloudFront Function by name.
      */
-    getOriginAccessControlById(originAccessControlId) {
-        return this.originAccessControls.byId(originAccessControlId);
+    getCloudFrontFunctionByName(cloudFrontFunctionName) {
+        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
     }
     /**
      * Get this service's CloudFormation Resource factory.

package/dist/service/ecr/authorize/sim-ecr-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimEcrRepositoryAddress } from "../repository/sim-ecr-repository-address.js";
+interface SimEcrAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly address: SimEcrRepositoryAddress;
+}
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export declare class SimEcrAuthorizer {
+    private readonly iam;
+    private readonly address;
+    constructor(properties: SimEcrAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action: string, repositoryName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/ecr/authorize/sim-ecr-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export class SimEcrAuthorizer {
+    iam;
+    address;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.address = properties.address;
+    }
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action, repositoryName, caller) {
+        const resource = this.address.arn(repositoryName);
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource,
+            });
+        }
+        return decision.caller;
+    }
+}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts

@@ -1,9 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimEcrAuthorizer } from "../../authorize/sim-ecr-authorizer.js";
 import type { SimEcrRepository } from "../../repository/sim-ecr-repository.js";
 import type { SimEcr } from "../../sim-ecr.js";
 interface SimCfnEcrRepositoryCreatorProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * Creates simulated repositories from AWS::ECR::Repository Resources.
@@ -16,11 +19,17 @@ interface SimCfnEcrRepositoryCreatorProperties {
  */
 export declare class SimCfnEcrRepositoryCreator {
     private readonly ecr;
+    private readonly authorizer;
     constructor(properties: SimCfnEcrRepositoryCreatorProperties);
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimEcrRepository;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimEcrRepository;
     /**
      * Delete a repository created from an AWS::ECR::Repository Resource.
      *
@@ -37,6 +46,6 @@ export declare class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource: SimCfnResource, repository: SimEcrRepository): void;
+    delete(resource: SimCfnResource, repository: SimEcrRepository, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.js

@@ -10,19 +10,27 @@ import { SimCfnEcrRepositoryProperties } from "./sim-cfn-ecr-repository-properti
  */
 export class SimCfnEcrRepositoryCreator {
     ecr;
+    authorizer;
     constructor(properties) {
         this.ecr = properties.ecr;
+        this.authorizer = properties.authorizer;
     }
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
         const repositoryProperties = new SimCfnEcrRepositoryProperties({
             resource,
             properties,
         });
         const repositoryName = repositoryProperties.repositoryName();
         repositoryProperties.recordIgnoredProperties();
+        this.authorizer.authorizeRepository("ecr:CreateRepository", repositoryName, options?.caller);
         return this.ecr.repository(repositoryName);
     }
     /**
@@ -41,7 +49,8 @@ export class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource, repository) {
+    delete(resource, repository, options) {
+        this.authorizer.authorizeRepository("ecr:DeleteRepository", repository.repositoryName, options?.caller);
         if (repository.hasImage) {
             throw new Error(`Unsupported sim ECR CloudFormation Resource ${resource.logicalId} ` +
                 `deletion: the simulated ECR repository ` +

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.d.ts

@@ -1,8 +1,10 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimEcrAuthorizer } from "../authorize/sim-ecr-authorizer.js";
 import type { SimEcr } from "../sim-ecr.js";
 interface SimEcrCfnResourceFactoryProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * CloudFormation Resource factory for simulated ECR resources.
@@ -21,6 +23,6 @@ export declare class SimEcrCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.js

@@ -1,5 +1,7 @@
 import { assertDefined } from "../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-creator.js";
+import { unsupportedSimEcrResourceType } from "./sim-ecr-cfn-unsupported-resource.js";
 /**
  * CloudFormation Resource factory for simulated ECR resources.
  *
@@ -10,30 +12,27 @@ import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-
 export class SimEcrCfnResourceFactory {
     repositoryCreator;
     constructor(properties) {
-        this.repositoryCreator = new SimCfnEcrRepositoryCreator({
-            ecr: properties.ecr,
-        });
+        this.repositoryCreator = new SimCfnEcrRepositoryCreator(properties);
     }
     /**
      * Create a simulated ECR resource from a CloudFormation Resource.
      */
     create(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, "");
         }
-        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties));
+        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller)));
     }
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName, resource) {
+    delete(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName} ` +
-                `deletion`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, " deletion");
         }
         const repository = resource.simResource;
         assertDefined(repository, `sim ECR repository for CloudFormation Resource ${resource.logicalId}`);
-        this.repositoryCreator.delete(resource, repository);
+        this.repositoryCreator.delete(resource, repository, simCfnResourceCallerOptions(context.caller));
         return Promise.resolve();
     }
 }

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export declare function unsupportedSimEcrResourceType(resourceTypeName: string, suffix: string): Error;

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.js

@@ -0,0 +1,9 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export function unsupportedSimEcrResourceType(resourceTypeName, suffix) {
+    return new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}${suffix}`);
+}

package/dist/service/ecr/sim-ecr.d.ts

@@ -1,9 +1,11 @@
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import type { SimEcrRepository } from "./repository/sim-ecr-repository.js";
 interface SimEcrProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly registry?: SimEcrRegistry;
 }
 /**
@@ -19,6 +21,11 @@ interface SimEcrProperties {
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export declare class SimEcr {
     private readonly repositories;

package/dist/service/ecr/sim-ecr.js

@@ -1,4 +1,6 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
+import { SimEcrAuthorizer } from "./authorize/sim-ecr-authorizer.js";
 import { SimEcrCfnResourceFactory } from "./cfn/sim-ecr-cfn-resource-factory.js";
 import { SimEcrRegistry } from "./registry/sim-ecr-registry.js";
 import { SimEcrRepositoryAddress } from "./repository/sim-ecr-repository-address.js";
@@ -16,15 +18,25 @@ import { SimEcrRepositoryStore } from "./repository/sim-ecr-repository-store.js"
  * Repositories are scoped to an account and region, as they are on real AWS:
  * a repository ARN names the region, and the registry host in an image URI
  * carries both the account and the region.
+ *
+ * Nothing a test does here is authorized, for the same reason. Naming a
+ * repository is the simulator's own accessor, and no principal makes that
+ * request. A CloudFormation deployment does make one, and a Stack making or
+ * removing a repository is decided by simulated IAM as the caller it named.
  */
 export class SimEcr {
     repositories;
-    cfnFactory = new SimEcrCfnResourceFactory({ ecr: this });
+    cfnFactory;
     constructor(properties = {}) {
         const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), registry = new SimEcrRegistry(), } = properties;
-        this.repositories = new SimEcrRepositoryStore({
-            address: new SimEcrRepositoryAddress(accountRegionScope),
-            registry,
+        const address = new SimEcrRepositoryAddress(accountRegionScope);
+        this.repositories = new SimEcrRepositoryStore({ address, registry });
+        this.cfnFactory = new SimEcrCfnResourceFactory({
+            ecr: this,
+            authorizer: new SimEcrAuthorizer({
+                iam: simIamInRegion(properties.iam, accountRegionScope.regionName),
+                address,
+            }),
         });
     }
     /**

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.d.ts

@@ -18,11 +18,23 @@ interface SimEcsAuthorizerProperties {
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export declare class SimEcsAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEcsAuthorizerProperties);
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEcsRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.
      *

package/dist/service/ecs/command/authorize/sim-ecs-authorizer.js

@@ -1,5 +1,7 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
 import { SimEcsAccessDeniedException } from "../../error/sim-ecs.error.js";
+import { simEcsTasksServicePrincipal } from "../../sim-ecs-service-principal.js";
 /**
  * The resource an ECS action with no resource type authorizes against.
  *
@@ -24,12 +26,31 @@ const noResource = "*";
  * A denial is reported as ECS's own AccessDeniedException rather than the
  * shared IAM error, because that is the error a real ECS caller would have to
  * handle.
+ *
+ * A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS
+ * Roles it runs the task as later, and each one is authorized as
+ * `iam:PassRole` against the Role itself.
  */
 export class SimEcsAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEcsTasksServicePrincipal,
+            denied: (denial) => new SimEcsAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand ECS every Role a task definition names.
+     *
+     * Both Roles are optional on a registration, and one left out passes
+     * nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a cluster, named by its ARN.