@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/ecs/command/register-task-definition/register-task-definition.handler.js

@@ -47,6 +47,7 @@ export class RegisterTaskDefinitionCommandHandler extends SimEcsCommandHandler {
         const settings = new SimEcsTaskDefinitionSettings(command.input);
         await this.sequence();
         const caller = this.authorizer.authorizeAnyResource("ecs:RegisterTaskDefinition", options);
+        this.authorizer.authorizePassRole([settings.taskRoleArn, settings.executionRoleArn], options);
         const familyRevisions = this.taskDefinitions.family(family);
         const revision = familyRevisions.nextRevisionNumber();
         const taskDefinition = new SimEcsTaskDefinition({

package/dist/service/ecs/sim-ecs-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export declare const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/ecs/sim-ecs-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal ECS holds a task's Roles as.
+ *
+ * A task role and a task execution role are both trusted by this principal,
+ * and it is what `iam:PassedToService` carries when a task definition is
+ * registered.
+ */
+export const simEcsTasksServicePrincipal = "ecs-tasks.amazonaws.com";

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.d.ts

@@ -16,6 +16,11 @@ interface SimEventBridgeAuthorizerProperties {
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -24,7 +29,14 @@ interface SimEventBridgeAuthorizerProperties {
 export declare class SimEventBridgeAuthorizer {
     private readonly iam;
     private readonly callerIdentifier;
+    private readonly passRole;
     constructor(properties: SimEventBridgeAuthorizerProperties);
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.
      *

package/dist/service/eventbridge/command/authorize/sim-event-bridge-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer, simIamPassRoleDenialMessage, } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { simEventBridgeServicePrincipal } from "../../delivery/sim-event-bridge-delivery.js";
 import { SimEventBridgeAccessDeniedException } from "../../error/sim-event-bridge.error.js";
 /**
  * The resource an action with no resource type authorizes against.
@@ -20,6 +22,11 @@ const noResource = "*";
  * answers a refused request with. It has no error of its own for the case, so
  * there is nothing service-specific to translate to.
  *
+ * A target carrying a `RoleArn` hands EventBridge a Role it runs the target
+ * as later, and that is authorized as `iam:PassRole` against the Role. An ECS
+ * target is the only one this simulation reads a `RoleArn` from, since a
+ * `RoleArn` on any other target is refused.
+ *
  * Event bus resource policies are not part of the decision yet, because
  * nothing sets one: PutPermission and the bus `Policy` attribute are not
  * simulated. A caller from another Account therefore has no way to be admitted
@@ -28,8 +35,22 @@ const noResource = "*";
 export class SimEventBridgeAuthorizer {
     iam;
     callerIdentifier = new SimIamCallerIdentifier();
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simEventBridgeServicePrincipal,
+            denied: (denial) => new SimEventBridgeAccessDeniedException(simIamPassRoleDenialMessage(denial)),
+        });
+    }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A target with no Role of its own passes nothing.
+     */
+    authorizePassRole(roleArns, options) {
+        this.passRole.authorizeAll(roleArns, options?.caller);
     }
     /**
      * Ensure the caller may perform an action on a bus, named by its ARN.

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.d.ts

@@ -19,6 +19,12 @@ interface SimEventBridgeRuleAccessProperties {
     readonly authorizer: SimEventBridgeAuthorizer;
     readonly accountRegionScope: SimAwsAccountRegionScope;
 }
+/**
+ * The part of a target that names a Role.
+ */
+interface SimEventBridgeTargetRole {
+    readonly RoleArn?: string | undefined;
+}
 interface SimEventBridgeRuleRequest {
     readonly Name?: string | undefined;
     readonly EventBusName?: string | undefined;
@@ -48,6 +54,13 @@ export declare class SimEventBridgeRuleAccess {
      * Ensure the caller may perform an action on a rule, which need not exist.
      */
     authorize(action: string, requested: SimEventBridgeRequestedRule, options?: SimEventBridgeRequestOptions): void;
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets: readonly SimEventBridgeTargetRole[], options?: SimEventBridgeRequestOptions): void;
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/rule/sim-event-bridge-rule-access.js

@@ -37,6 +37,15 @@ export class SimEventBridgeRuleAccess {
     authorize(action, requested, options) {
         this.authorizer.authorizeBus(action, this.arnFor(requested), options);
     }
+    /**
+     * Ensure the caller may hand EventBridge every Role a request names.
+     *
+     * A rule runs its targets as the Role each one carries, long after the
+     * request that put them there, so adding one is a hand-over of that Role.
+     */
+    authorizePassRole(targets, options) {
+        this.authorizer.authorizePassRole(targets.map((target) => target.RoleArn), options);
+    }
     /**
      * Resolve the rule a request names, authorizing the action first.
      */

package/dist/service/eventbridge/command/target/sim-event-bridge-put-targets.js

@@ -33,6 +33,7 @@ export class SimEventBridgePutTargets {
         for (const target of requested) {
             refuseUnsimulatedTargetInput(target);
         }
+        this.access.authorizePassRole(requested, options);
         const added = requested.map((target) => SimEventTarget.of(target));
         refuseRepeatedTargetIds(added);
         const busName = rule.busName.value;

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.d.ts

@@ -11,10 +11,22 @@ interface SimFirehoseAuthorizerProperties {
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export declare class SimFirehoseAuthorizer {
     private readonly iam;
+    private readonly passRole;
     constructor(properties: SimFirehoseAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], caller?: SimAwsCaller): void;
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its
      * ARN.

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -1,4 +1,6 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simFirehoseServicePrincipal } from "../../sim-firehose-service-principal.js";
 /**
  * Applies simulated IAM authorization to Firehose requests.
  *
@@ -6,11 +8,29 @@ import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
  * name, and the resource is the ARN of the delivery stream the operation names.
  * ListDeliveryStreams is the exception. It names no delivery stream, so it
  * authorizes against `*`.
+ *
+ * A delivery stream carries a Role for its destination, and a second one for
+ * its source where it reads a Kinesis stream. Firehose keeps both and delivers
+ * as them later, so creating one authorizes `iam:PassRole` against each.
  */
 export class SimFirehoseAuthorizer {
     iam;
+    passRole;
     constructor(properties) {
         this.iam = properties.iam;
+        this.passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simFirehoseServicePrincipal,
+        });
+    }
+    /**
+     * Ensure the caller may hand Firehose every Role a delivery stream names.
+     *
+     * A delivery stream taking records through PutRecord has no source Role, and
+     * one left out passes nothing.
+     */
+    authorizePassRole(roleArns, caller) {
+        this.passRole.authorizeAll(roleArns, caller);
     }
     /**
      * Ensure the caller may perform an action on a delivery stream, named by its

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.d.ts

@@ -38,6 +38,10 @@ export declare class SimFirehoseDeliveryStreamAccess {
      * stream.
      */
     authorizeAny(action: string, options?: SimFirehoseRequestOptions): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns: readonly (string | undefined)[], options?: SimFirehoseRequestOptions): void;
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/sim-firehose-delivery-stream-access.js

@@ -37,6 +37,12 @@ export class SimFirehoseDeliveryStreamAccess {
     authorizeAny(action, options) {
         return this.authorizer.authorizeAnyDeliveryStream(action, options?.caller);
     }
+    /**
+     * Ensure the caller may hand Firehose every Role a request names.
+     */
+    authorizePassRole(roleArns, options) {
+        this.authorizer.authorizePassRole(roleArns, options?.caller);
+    }
     /**
      * Resolve the delivery stream a request names, authorizing the action first.
      */

package/dist/service/firehose/command/stream/sim-firehose-create-delivery-stream.js

@@ -44,11 +44,13 @@ export class SimFirehoseCreateDeliveryStream {
         this.requireNameFree(name);
         const createdAt = this.background.now();
         const source = simFirehoseSourceOf(input, this.scope, createdAt);
+        const destination = simFirehoseDestinationOf(input);
+        this.access.authorizePassRole([destination.roleArn, source.roleArn], options);
         const arn = simFirehoseDeliveryStreamArn(this.scope, name);
         const deliveryStream = new SimFirehoseDeliveryStream({
             name,
             arn,
-            destination: simFirehoseDestinationOf(input),
+            destination,
             source,
             createdAt,
         });

package/dist/service/firehose/sim-firehose-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export declare const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/sim-firehose-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal Firehose reads and delivers as.
+ *
+ * A delivery stream's destination Role and its source Role are both trusted by
+ * this principal, and it is what `iam:PassedToService` carries when a delivery
+ * stream is created.
+ */
+export const simFirehoseServicePrincipal = "firehose.amazonaws.com";

package/dist/service/firehose/source/sim-firehose-source.d.ts

@@ -14,6 +14,11 @@ export type SimFirehoseDeliveryStreamType = "DirectPut" | "KinesisStreamAsSource
 export declare class SimFirehoseDirectPutSource {
     readonly kind: "direct-put";
     readonly deliveryStreamType: "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    readonly roleArn: undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/firehose/source/sim-firehose-source.js

@@ -5,6 +5,11 @@ import { SimFirehoseInvalidArgumentException } from "../error/sim-firehose.error
 export class SimFirehoseDirectPutSource {
     kind = "direct-put";
     deliveryStreamType = "DirectPut";
+    /**
+     * The Role reading is done as, which a delivery stream taking puts has none
+     * of. It reads nothing, so there is nothing for a Role to read it as.
+     */
+    roleArn = undefined;
     /**
      * Take a put, which is where this delivery stream's records come from.
      */

package/dist/service/glue/cfn/database/sim-cfn-glue-database-properties.js

@@ -1,6 +1,7 @@
 import { glueCfnPropertyError } from "../sim-cfn-glue-property-error.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueDatabaseRules } from "./sim-cfn-glue-database-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Database";
 /**
  * Reads AWS::Glue::Database CloudFormation properties.
@@ -28,10 +29,9 @@ export class SimCfnGlueDatabaseProperties {
      */
     databaseName() {
         const values = this.#values;
-        const stackName = this.#resource.stackName ?? "stack";
         return (values.optionalString(this.#input()["Name"], "DatabaseInput.Name") ??
             values.optionalString(this.#properties["DatabaseName"], "DatabaseName") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+            simCfnGlueGeneratedName(this.#resource));
     }
     /** What the database is created with, beyond its name. */
     databaseInput() {

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export declare function simCfnGlueGeneratedName(resource: SimCfnResource): string;

package/dist/service/glue/cfn/sim-cfn-glue-generated-name.js

@@ -0,0 +1,25 @@
+import { SimCfnGeneratedResourceName } from "../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { simGlueFolded } from "../database/sim-glue-catalog-name.js";
+/**
+ * The longest name the Data Catalog accepts for a database or a table.
+ *
+ * Glue states the limit in UTF-8 bytes and `SimCfnGeneratedResourceName` trims
+ * by character. The two come to the same thing here. A logical ID is
+ * alphanumeric, a stack name adds only hyphens, and the tail is hex.
+ */
+const maximumNameLength = 255;
+/**
+ * The name CloudFormation gives a database or a table whose template does not
+ * name it.
+ *
+ * One function covers both because the Data Catalog gives a database and a
+ * table the same name rules. The name is folded to lowercase the way the
+ * catalog folds any name it stores, for compatibility with Apache Hive.
+ */
+export function simCfnGlueGeneratedName(resource) {
+    return simGlueFolded(new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength: maximumNameLength,
+    }).value);
+}

package/dist/service/glue/cfn/table/sim-cfn-glue-table-properties.js

@@ -3,6 +3,7 @@ import { SimCfnGlueRecord } from "../sim-cfn-glue-record.js";
 import { SimCfnGlueValues } from "../sim-cfn-glue-values.js";
 import { SimCfnGlueTableInputReader } from "./sim-cfn-glue-table-input.js";
 import { simCfnGlueTableIgnored } from "./sim-cfn-glue-table-rules.js";
+import { simCfnGlueGeneratedName } from "../sim-cfn-glue-generated-name.js";
 const resourceType = "AWS::Glue::Table";
 /**
  * Reads AWS::Glue::Table CloudFormation properties.
@@ -32,9 +33,7 @@ export class SimCfnGlueTableProperties {
      * since Glue names are lowercase for Hive compatibility.
      */
     tableName() {
-        const stackName = this.#resource.stackName ?? "stack";
-        return (this.#input().string("Name") ??
-            `${stackName}-${this.#resource.logicalId}`.toLowerCase());
+        return (this.#input().string("Name") ?? simCfnGlueGeneratedName(this.#resource));
     }
     /** What the table is created with, beyond its name and its database. */
     tableInput() {

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -6,6 +6,12 @@ interface SimIamAllowSidesProperties {
      * Defaults to the resource side, for callers with no reason to distinguish.
      */
     readonly resourceDirect?: boolean | undefined;
+    /**
+     * Whether a resource-policy Allow named the caller, rather than admitting it
+     * as one of a wider set through a wildcard principal. Defaults to the
+     * resource side in the same way.
+     */
+    readonly resourceNamesCaller?: boolean | undefined;
 }
 /**
  * Which sides of a policy evaluation produced a matching Allow.
@@ -19,6 +25,7 @@ export declare class SimIamAllowSides {
     private readonly identityAllowed;
     private readonly resourceAllowed;
     private readonly resourceDirectAllowed;
+    private readonly resourceNamesCallerAllowed;
     constructor(properties: SimIamAllowSidesProperties);
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +36,8 @@ export declare class SimIamAllowSides {
      */
     get resource(): boolean;
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect(): boolean;
     /**
@@ -38,6 +45,11 @@ export declare class SimIamAllowSides {
      * its Account, which grants nothing on its own.
      */
     get resourceDelegated(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller(): boolean;
 }
 /**
  * Which sides of an authorization must allow a request for it to be allowed.
@@ -97,6 +109,26 @@ export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamA
      */
     isSatisfiedBy(allows: SimIamAllowSides): boolean;
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service, and an identity
+ * policy has to allow the action as well.
+ *
+ * Nothing in the simulation asks for this rule. Parameter Store is the case it
+ * was written for, and the aws/ssm key policy grants its cryptographic actions
+ * to a wildcard principal outright.
+ */
+export declare class SimIamCallerPermissionRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
 /**
  * Every applicable rule at once.
  *

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -10,11 +10,14 @@ export class SimIamAllowSides {
     identityAllowed;
     resourceAllowed;
     resourceDirectAllowed;
+    resourceNamesCallerAllowed;
     constructor(properties) {
         this.identityAllowed = properties.identity;
         this.resourceAllowed = properties.resource;
         this.resourceDirectAllowed =
             properties.resourceDirect ?? properties.resource;
+        this.resourceNamesCallerAllowed =
+            properties.resourceNamesCaller ?? properties.resource;
     }
     /**
      * Whether an identity-based policy allowed the request.
@@ -29,8 +32,8 @@ export class SimIamAllowSides {
         return this.resourceAllowed;
     }
     /**
-     * Whether a resource-based policy allowed the request by naming the caller,
-     * rather than by delegating to the caller's Account.
+     * Whether a resource-based policy allowed the request without delegating to
+     * the caller's Account.
      */
     get resourceDirect() {
         return this.resourceDirectAllowed;
@@ -42,6 +45,13 @@ export class SimIamAllowSides {
     get resourceDelegated() {
         return this.resourceAllowed && !this.resourceDirectAllowed;
     }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by admitting whoever the request came from.
+     */
+    get resourceNamesCaller() {
+        return this.resourceNamesCallerAllowed;
+    }
 }
 /**
  * The same-Account rule: an Allow from either side is enough.
@@ -104,6 +114,28 @@ export class SimIamMandatoryResourcePolicyRequirement {
         return allows.resourceDelegated && allows.identity;
     }
 }
+/**
+ * The rule for a request one service makes to another with the caller's own
+ * permissions. The caller needs the permission itself.
+ *
+ * A resource policy naming the caller still allows the request on its own, as
+ * a KMS key policy naming a Role does. A policy admitting whoever the request
+ * came from does not, because what it admits is the service, and an identity
+ * policy has to allow the action as well.
+ *
+ * Nothing in the simulation asks for this rule. Parameter Store is the case it
+ * was written for, and the aws/ssm key policy grants its cryptographic actions
+ * to a wildcard principal outright.
+ */
+export class SimIamCallerPermissionRequirement {
+    /**
+     * Whether the caller holds the permission itself, or was named outright by
+     * the resource.
+     */
+    isSatisfiedBy(allows) {
+        return allows.resourceNamesCaller || allows.identity;
+    }
+}
 /**
  * Every applicable rule at once.
  *

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -16,12 +16,13 @@ export declare class SimIamAllowStatements {
     private readonly resourceStatements;
     private readonly trustStatements;
     private readonly delegatedStatements;
+    private readonly namingStatements;
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -13,12 +13,13 @@ export class SimIamAllowStatements {
     resourceStatements = [];
     trustStatements = [];
     delegatedStatements = [];
+    namingStatements = [];
     /**
      * Record a matching Allow against the policy side it came from.
      *
-     * A resource-policy Allow that matched by way of the caller's Account rather
-     * than the caller itself is kept apart as well, so a rule that cares about
-     * the difference can ask for it.
+     * How a resource-policy Allow came to match is kept alongside it, for the
+     * rules that care. A statement can match by way of the caller's Account, by
+     * naming the caller, or by admitting whoever the request came from.
      */
     record(policy, statement, principal) {
         if (policy.sourceType === "trust") {
@@ -27,6 +28,9 @@ export class SimIamAllowStatements {
         if (principal.isAccountDelegation) {
             this.delegatedStatements.push(statement);
         }
+        if (principal.namesCaller) {
+            this.namingStatements.push(statement);
+        }
         this.sideStatements(policy).push(statement);
     }
     /**
@@ -58,10 +62,12 @@ export class SimIamAllowStatements {
      */
     get sides() {
         const delegated = new Set(this.delegatedStatements);
+        const naming = new Set(this.namingStatements);
         return new SimIamAllowSides({
             identity: this.identityStatements.length > 0,
             resource: this.resourceStatements.length > 0,
             resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
+            resourceNamesCaller: this.resourceStatements.some((statement) => naming.has(statement)),
         });
     }
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -1,16 +1,25 @@
 import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * What an authorization request says about the rules it is subject to, beyond
+ * the caller and the policies themselves.
+ */
+export interface SimIamAllowRequirementInput {
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+    readonly withCallerPermissions?: boolean | undefined;
+}
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export declare class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+    resolve(callerAccount: SimIamCallerAccount, input: SimIamAllowRequirementInput): SimIamAllowRequirement;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -1,23 +1,27 @@
-import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+import { SimIamCallerPermissionRequirement, SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
 /**
  * Works out which allow rules apply to one authorization request.
  *
- * Two things decide it, and both have to hold. The caller's Account says whose
- * Allow counts: either side within one Account, both sides across Accounts.
- * The resource-owning service says whether its resource insists on allowing,
- * which is true of a KMS key and of nothing else so far.
+ * Three things decide it, and all of them have to hold. The caller's Account
+ * says whose Allow counts: either side within one Account, both sides across
+ * Accounts. The resource-owning service says whether its resource insists on
+ * allowing, which is true of a KMS key and of nothing else so far, and whether
+ * it is passing on the caller's own permissions rather than its own.
  */
 export class SimIamAuthZAllowRequirement {
     /**
      * The rule a request is subject to.
      */
-    resolve(callerAccount, requiresResourcePolicyAllow) {
-        if (requiresResourcePolicyAllow !== true) {
-            return callerAccount.allowRequirement;
-        }
-        return new SimIamEveryAllowRequirement([
+    resolve(callerAccount, input) {
+        const requirements = [
             callerAccount.allowRequirement,
-            new SimIamMandatoryResourcePolicyRequirement(),
-        ]);
+        ];
+        if (input.requiresResourcePolicyAllow === true) {
+            requirements.push(new SimIamMandatoryResourcePolicyRequirement());
+        }
+        if (input.withCallerPermissions === true) {
+            requirements.push(new SimIamCallerPermissionRequirement());
+        }
+        return new SimIamEveryAllowRequirement(requirements);
     }
 }