@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,5 +1,6 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
@@ -23,13 +24,18 @@ export interface SimIamAuthZCallerContextBuilderProperties {
      * The caller this simulation attributes an unattributed request to.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where an unattributed request looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * A request that omits a caller is decided as the simulation's default caller,
- * and as the Account root where the simulation named none. An explicit
- * anonymous caller falls back to neither.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export declare class SimIamAuthZCallerContextBuilder {
     private readonly callerResolver;

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -2,9 +2,10 @@ import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolv
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * A request that omits a caller is decided as the simulation's default caller,
- * and as the Account root where the simulation named none. An explicit
- * anonymous caller falls back to neither.
+ * A request that omits a caller is decided as the ambient caller of the run-as
+ * block it is inside, then as the simulation's default caller, and as the
+ * Account root where there is neither. An explicit anonymous caller falls back
+ * to none of them.
  */
 export class SimIamAuthZCallerContextBuilder {
     callerResolver;
@@ -17,6 +18,7 @@ export class SimIamAuthZCallerContextBuilder {
         this.callerResolver = new SimAwsCallerResolver({
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
         });
     }
     /**

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,81 +1,15 @@
 import type { SimArn } from "../../../aws/arn.js";
-import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
-import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
-import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicy } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
-import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
-import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthorizationInput } from "./sim-iam-auth-z-input.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
 import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
-export interface SimIamResourcePolicyInput {
-    readonly document: SimIamPolicyDocument;
-    readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
-    readonly policyName?: string | undefined;
-    readonly resourceArn?: string | undefined;
-}
-/**
- * Entry-point input for sim IAM allow/deny authorization.
- */
-export interface SimIamAuthorizationInput {
-    readonly action: string;
-    readonly resource: string;
-    /**
-     * The Region the request was made in, which sim IAM derives
-     * `aws:RequestedRegion` from.
-     *
-     * A simulated service supplies its own Region. A request reaching one
-     * through its command handlers therefore carries it, with the caller saying
-     * nothing. IAM itself belongs to an Account and has no Region to fall back
-     * on. A request arriving without one leaves the key out of the condition
-     * context, and a statement conditioned on it matches nothing.
-     */
-    readonly region?: AwsRegionName | undefined;
-    /**
-     * Condition values known by the service handling the simulated request, such
-     * as S3 object tags. Sim IAM automatically supplies global condition values
-     * that it can derive itself, such as AWS:PrincipalArn.
-     *
-     * Context-key names are matched case-insensitively by the condition matcher,
-     * while string values remain case-sensitive. IAM-derived values take
-     * precedence over supplied values for equivalent keys.
-     */
-    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
-    /**
-     * Condition values the service can only supply once IAM has resolved the
-     * caller, such as the Account a KMS request came from.
-     *
-     * These are combined with the values supplied directly, and IAM-derived
-     * values still take precedence over both.
-     */
-    readonly callerConditions?: SimIamCallerConditionSource | undefined;
-    /**
-     * Simulated request caller.
-     *
-     * If credentials are supplied, they are authenticated before policy
-     * evaluation. If omitted, authorization defaults to the Account root.
-     */
-    readonly caller?: SimAwsCaller | undefined;
-    /**
-     * Resource policies supplied by the service that owns the target resource.
-     *
-     * Resource policies are not loaded from IAM's managed-policy store. They are
-     * supplied by the target service, such as an S3 Bucket policy or other
-     * service-level resource policy.
-     */
-    readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
-    /**
-     * Whether the resource's own policy must allow the request.
-     *
-     * Off by default, which is the ordinary AWS rule: a resource with no policy
-     * leaves the decision to the caller's identity policies. A service sets it
-     * for a resource whose policy is mandatory and is the root of trust for
-     * reaching it, which in AWS means a KMS key policy.
-     */
-    readonly requiresResourcePolicyAllow?: boolean | undefined;
-}
 interface SimIamAuthZContextBuilderProperties {
     /**
      * The Account whose IAM is evaluating the request.
@@ -86,6 +20,10 @@ interface SimIamAuthZContextBuilderProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation, for the identity side
      * of a cross-Account request.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -47,6 +47,7 @@ export class SimIamAuthZContextBuilder {
             accountRootPrincipal: makeSimAwsAccountRootPrincipal(properties.accountId),
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
         });
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
             policies: properties.policies,
@@ -75,7 +76,7 @@ export class SimIamAuthZContextBuilder {
             ],
             resourcePolicies: this.resourcePolicySources(input),
             serviceControlPolicies: this.scpSourceBuilder.build(callerContext.caller),
-            allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
+            allowRequirement: this.allowRequirement.resolve(callerAccount, input),
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.d.ts

@@ -0,0 +1,89 @@
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
+import type { SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+export interface SimIamResourcePolicyInput {
+    readonly document: SimIamPolicyDocument;
+    readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
+    readonly policyName?: string | undefined;
+    readonly resourceArn?: string | undefined;
+}
+/**
+ * Entry-point input for sim IAM allow/deny authorization.
+ */
+export interface SimIamAuthorizationInput {
+    readonly action: string;
+    readonly resource: string;
+    /**
+     * The Region the request was made in, which sim IAM derives
+     * `aws:RequestedRegion` from.
+     *
+     * A simulated service supplies its own Region. A request reaching one
+     * through its command handlers therefore carries it, with the caller saying
+     * nothing. IAM itself belongs to an Account and has no Region to fall back
+     * on. A request arriving without one leaves the key out of the condition
+     * context, and a statement conditioned on it matches nothing.
+     */
+    readonly region?: AwsRegionName | undefined;
+    /**
+     * Condition values known by the service handling the simulated request, such
+     * as S3 object tags. Sim IAM automatically supplies global condition values
+     * that it can derive itself, such as AWS:PrincipalArn.
+     *
+     * Context-key names are matched case-insensitively by the condition matcher,
+     * while string values remain case-sensitive. IAM-derived values take
+     * precedence over supplied values for equivalent keys.
+     */
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+    /**
+     * Condition values the service can only supply once IAM has resolved the
+     * caller, such as the Account a KMS request came from.
+     *
+     * These are combined with the values supplied directly, and IAM-derived
+     * values still take precedence over both.
+     */
+    readonly callerConditions?: SimIamCallerConditionSource | undefined;
+    /**
+     * Simulated request caller.
+     *
+     * If credentials are supplied, they are authenticated before policy
+     * evaluation. If omitted, authorization falls back to the ambient caller of
+     * the run-as block the request is inside, then to the simulation's default
+     * caller, and then to the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Resource policies supplied by the service that owns the target resource.
+     *
+     * Resource policies are not loaded from IAM's managed-policy store. They are
+     * supplied by the target service, such as an S3 Bucket policy or other
+     * service-level resource policy.
+     */
+    readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
+    /**
+     * Whether the resource's own policy must allow the request.
+     *
+     * Off by default, which is the ordinary AWS rule: a resource with no policy
+     * leaves the decision to the caller's identity policies. A service sets it
+     * for a resource whose policy is mandatory and is the root of trust for
+     * reaching it, which in AWS means a KMS key policy.
+     */
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+    /**
+     * Whether the service is making this request with the caller's own
+     * permissions rather than with its own.
+     *
+     * Off by default, which is the ordinary AWS rule. Within one Account a
+     * resource policy admitting the caller is enough on its own. A service sets
+     * this where it reaches another service as the caller. A resource policy
+     * that admits whoever the request came from then grants nothing by itself,
+     * because what it admits is the service. A resource policy naming the caller
+     * still allows the request on its own.
+     *
+     * No simulated service sets this. Parameter Store is the case it was written
+     * for, and the aws/ssm key policy grants its cryptographic actions to a
+     * wildcard principal outright.
+     */
+    readonly withCallerPermissions?: boolean | undefined;
+}

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -44,9 +44,12 @@ export declare class SimIamPolicyPrincipalMatcher {
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
-     * The wildcard matches both authenticated and anonymous requests. Other AWS
-     * forms require an ARN-based caller. Account delegation forms compare against
-     * the account ID derived by the caller resolver.
+     * The wildcard matches both authenticated and anonymous requests, and names
+     * neither. Other AWS forms require an ARN-based caller. Account delegation
+     * forms compare against the account ID derived by the caller resolver. An
+     * ARN carrying a wildcard of its own admits a set of principals without
+     * naming one, so it counts as a match on the same terms as `*`. Real IAM
+     * accepts no wildcard inside a Principal ARN at all.
      *
      * A pattern is compared against two ARNs, because an assumed-role session
      * has two. The session ARN is the caller, and the Role behind it is the
@@ -55,6 +58,11 @@ export declare class SimIamPolicyPrincipalMatcher {
      * that is not a session, so one comparison happens in that case.
      */
     private awsPatternMatches;
+    /**
+     * The kind of match an ARN principal pattern makes, by whether it names one
+     * principal or admits a set of them.
+     */
+    private arnPatternMatch;
     /**
      * Whether a principal pattern names one of the caller's ARNs.
      */

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -38,9 +38,9 @@ export class SimIamPolicyPrincipalMatcher {
             return this.valueMatches(statement.principal);
         }
         if (statement.notPrincipal !== undefined) {
-            // Excluding the caller says nothing about the Account delegating, so a
-            // NotPrincipal that leaves the caller in is a direct grant.
-            return SimIamPrincipalMatch.direct().when(!this.valueMatches(statement.notPrincipal).matched);
+            // Leaving the caller out of the exclusion admits it without naming it,
+            // in the way a wildcard principal does.
+            return SimIamPrincipalMatch.everyone().when(!this.valueMatches(statement.notPrincipal).matched);
         }
         return SimIamPrincipalMatch.none();
     }
@@ -78,9 +78,12 @@ export class SimIamPolicyPrincipalMatcher {
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
-     * The wildcard matches both authenticated and anonymous requests. Other AWS
-     * forms require an ARN-based caller. Account delegation forms compare against
-     * the account ID derived by the caller resolver.
+     * The wildcard matches both authenticated and anonymous requests, and names
+     * neither. Other AWS forms require an ARN-based caller. Account delegation
+     * forms compare against the account ID derived by the caller resolver. An
+     * ARN carrying a wildcard of its own admits a set of principals without
+     * naming one, so it counts as a match on the same terms as `*`. Real IAM
+     * accepts no wildcard inside a Principal ARN at all.
      *
      * A pattern is compared against two ARNs, because an assumed-role session
      * has two. The session ARN is the caller, and the Role behind it is the
@@ -90,7 +93,7 @@ export class SimIamPolicyPrincipalMatcher {
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
-            return SimIamPrincipalMatch.direct();
+            return SimIamPrincipalMatch.everyone();
         }
         const caller = this.context.caller;
         if (caller.arn === undefined) {
@@ -100,9 +103,18 @@ export class SimIamPolicyPrincipalMatcher {
         if (delegatedAccountId !== undefined) {
             return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return SimIamPrincipalMatch.direct().when(this.arnMatches(pattern, caller.arn) ||
+        return this.arnPatternMatch(pattern).when(this.arnMatches(pattern, caller.arn) ||
             this.arnMatches(pattern, caller.identityPolicyArn));
     }
+    /**
+     * The kind of match an ARN principal pattern makes, by whether it names one
+     * principal or admits a set of them.
+     */
+    arnPatternMatch(pattern) {
+        return pattern.includes("*") || pattern.includes("?")
+            ? SimIamPrincipalMatch.everyone()
+            : SimIamPrincipalMatch.direct();
+    }
     /**
      * Whether a principal pattern names one of the caller's ARNs.
      */

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts

@@ -1,16 +1,32 @@
 /**
  * How a resource-policy statement came to apply to the caller.
  *
- * AWS treats these two differently. A statement naming the caller's own ARN is
- * a grant to that principal. A statement naming the Account, as a bare account
- * ID or a root ARN, delegates the decision to that Account's IAM rather than
- * granting anything by itself. Most of this simulator does not yet act on the
- * difference; a KMS key policy does, because it is the whole reason the
- * default key policy does not make a key usable by everyone in the Account.
+ * AWS treats these apart. A statement naming the caller's own ARN is a grant
+ * to that principal. A statement naming the Account, as a bare account ID or a
+ * root ARN, delegates the decision to that Account's IAM and grants nothing by
+ * itself. A statement whose principal is a wildcard names nobody. It admits
+ * whoever the request came from, and a service calling with the caller's own
+ * permissions still needs IAM to allow that caller.
+ *
+ * A KMS key policy is where the difference shows. It is the whole reason the
+ * default key policy leaves a key unusable by the Account's principals until
+ * IAM allows them, and the reason the aws/ssm key leaves a SecureString
+ * unreadable to a caller holding no kms:Decrypt.
  */
 export declare class SimIamPrincipalMatch {
+    /**
+     * Whether the statement applies to the caller at all.
+     */
     readonly matched: boolean;
+    /**
+     * Whether the statement applies by way of the caller's Account.
+     */
     readonly isAccountDelegation: boolean;
+    /**
+     * Whether the statement named the caller, rather than admitting it as one
+     * of a wider set.
+     */
+    readonly namesCaller: boolean;
     private constructor();
     /**
      * The statement does not apply to this caller.
@@ -24,11 +40,16 @@ export declare class SimIamPrincipalMatch {
      * The statement applies by way of the caller's Account.
      */
     static accountDelegation(): SimIamPrincipalMatch;
+    /**
+     * The statement applies to whoever made the request, naming nobody.
+     */
+    static everyone(): SimIamPrincipalMatch;
     /**
      * The first match among alternatives, since Principal lists are an OR.
      *
-     * A direct match wins over a delegated one where both apply, because a
-     * statement naming the caller grants to the caller whatever else it says.
+     * A statement naming the caller wins over one that admits it some other
+     * way, because naming the caller grants to the caller whatever else the
+     * statement says.
      */
     static first(matches: readonly SimIamPrincipalMatch[]): SimIamPrincipalMatch;
     /**

package/dist/service/iam/authorize/match/sim-iam-principal-match.js

@@ -1,47 +1,72 @@
 /**
  * How a resource-policy statement came to apply to the caller.
  *
- * AWS treats these two differently. A statement naming the caller's own ARN is
- * a grant to that principal. A statement naming the Account, as a bare account
- * ID or a root ARN, delegates the decision to that Account's IAM rather than
- * granting anything by itself. Most of this simulator does not yet act on the
- * difference; a KMS key policy does, because it is the whole reason the
- * default key policy does not make a key usable by everyone in the Account.
+ * AWS treats these apart. A statement naming the caller's own ARN is a grant
+ * to that principal. A statement naming the Account, as a bare account ID or a
+ * root ARN, delegates the decision to that Account's IAM and grants nothing by
+ * itself. A statement whose principal is a wildcard names nobody. It admits
+ * whoever the request came from, and a service calling with the caller's own
+ * permissions still needs IAM to allow that caller.
+ *
+ * A KMS key policy is where the difference shows. It is the whole reason the
+ * default key policy leaves a key unusable by the Account's principals until
+ * IAM allows them, and the reason the aws/ssm key leaves a SecureString
+ * unreadable to a caller holding no kms:Decrypt.
  */
 export class SimIamPrincipalMatch {
+    /**
+     * Whether the statement applies to the caller at all.
+     */
     matched;
+    /**
+     * Whether the statement applies by way of the caller's Account.
+     */
     isAccountDelegation;
-    constructor(matched, isAccountDelegation) {
+    /**
+     * Whether the statement named the caller, rather than admitting it as one
+     * of a wider set.
+     */
+    namesCaller;
+    constructor(matched, isAccountDelegation, namesCaller) {
         this.matched = matched;
         this.isAccountDelegation = isAccountDelegation;
+        this.namesCaller = namesCaller;
     }
     /**
      * The statement does not apply to this caller.
      */
     static none() {
-        return new SimIamPrincipalMatch(false, false);
+        return new SimIamPrincipalMatch(false, false, false);
     }
     /**
      * The statement names this caller, or applies without naming an Account.
      */
     static direct() {
-        return new SimIamPrincipalMatch(true, false);
+        return new SimIamPrincipalMatch(true, false, true);
     }
     /**
      * The statement applies by way of the caller's Account.
      */
     static accountDelegation() {
-        return new SimIamPrincipalMatch(true, true);
+        return new SimIamPrincipalMatch(true, true, false);
+    }
+    /**
+     * The statement applies to whoever made the request, naming nobody.
+     */
+    static everyone() {
+        return new SimIamPrincipalMatch(true, false, false);
     }
     /**
      * The first match among alternatives, since Principal lists are an OR.
      *
-     * A direct match wins over a delegated one where both apply, because a
-     * statement naming the caller grants to the caller whatever else it says.
+     * A statement naming the caller wins over one that admits it some other
+     * way, because naming the caller grants to the caller whatever else the
+     * statement says.
      */
     static first(matches) {
         const matched = matches.filter((result) => result.matched);
-        return (matched.find((result) => !result.isAccountDelegation) ??
+        return (matched.find((result) => result.namesCaller) ??
+            matched.find((result) => !result.isAccountDelegation) ??
             matched[0] ??
             this.none());
     }

package/dist/service/iam/authorize/pass-role/sim-iam-pass-role-authorizer.d.ts

@@ -0,0 +1,74 @@
+import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../sim-iam-inter-service-auth-z.js";
+/**
+ * What a service needs to report a Role the caller may not pass.
+ */
+export interface SimIamPassRoleDenial {
+    readonly principal: SimAwsPrincipal;
+    readonly roleArn: string;
+    /**
+     * What else the message should say about why the request was denied, in the
+     * sense SimIamAccessDenied uses it.
+     */
+    readonly reason?: string | undefined;
+}
+interface SimIamPassRoleAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    /**
+     * The service principal the Role is being handed to, such as
+     * `lambda.amazonaws.com`. This is what `iam:PassedToService` carries.
+     */
+    readonly passedToService: string;
+    /**
+     * The error a refusal is reported as.
+     *
+     * Defaults to the shared IAM AccessDenied. A service reporting its own
+     * denials as its own error type supplies one, so a caller catching that type
+     * catches a refused Role along with everything else the service refused
+     * them.
+     */
+    readonly denied?: (denial: SimIamPassRoleDenial) => Error;
+}
+/**
+ * Authorizes handing a Role to a simulated service.
+ *
+ * A service given a Role to keep uses it under its own identity later, so
+ * being allowed to create the thing settles only half of the request. AWS asks
+ * separately whether the caller may hand that Role over, and the resource of
+ * that question is the Role. A scoped deployment role refused `iam:PassRole` is
+ * one of the commoner ways a real deployment stops.
+ *
+ * The Role need not exist. Real IAM decides a request before the service
+ * handles it, so a caller with no permission to pass a Role is refused whether
+ * or not the ARN names one.
+ */
+export declare class SimIamPassRoleAuthorizer {
+    private readonly iam;
+    private readonly passedToService;
+    private readonly denied;
+    constructor(properties: SimIamPassRoleAuthorizerProperties);
+    /**
+     * Ensure the caller may hand this Role to the service.
+     *
+     * A request naming no Role passes nothing and is left alone. That covers an
+     * optional Role, such as the one an update request omits to keep the Role
+     * already in place, and saves each call site repeating the check.
+     */
+    authorize(roleArn: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may hand every one of these Roles to the service.
+     *
+     * A Firehose delivery stream carrying a Role for its destination beside one
+     * for its source is what this is for. Each Role is its own question, and the
+     * first refusal is the one reported.
+     */
+    authorizeAll(roleArns: readonly (string | undefined)[], caller?: SimAwsCaller): void;
+}
+/**
+ * The message a service reports a refused Role with, in AWS's wording.
+ *
+ * A service reporting denials as its own error type builds its message from
+ * this, so a refused Role reads the same however it is reported.
+ */
+export declare function simIamPassRoleDenialMessage(denial: SimIamPassRoleDenial): string;
+export {};

package/dist/service/iam/authorize/pass-role/sim-iam-pass-role-authorizer.js

@@ -0,0 +1,92 @@
+import { SimIamCallerIdentifier } from "../../error/sim-iam-caller-identifier.js";
+import { SimIamAccessDenied } from "../../error/sim-iam.error.js";
+/**
+ * The IAM action a caller handing a Role to a service is authorized for.
+ */
+const passRoleAction = "iam:PassRole";
+/**
+ * The condition key naming the service the Role is being handed to.
+ */
+const passedToServiceKey = "iam:PassedToService";
+/**
+ * Authorizes handing a Role to a simulated service.
+ *
+ * A service given a Role to keep uses it under its own identity later, so
+ * being allowed to create the thing settles only half of the request. AWS asks
+ * separately whether the caller may hand that Role over, and the resource of
+ * that question is the Role. A scoped deployment role refused `iam:PassRole` is
+ * one of the commoner ways a real deployment stops.
+ *
+ * The Role need not exist. Real IAM decides a request before the service
+ * handles it, so a caller with no permission to pass a Role is refused whether
+ * or not the ARN names one.
+ */
+export class SimIamPassRoleAuthorizer {
+    iam;
+    passedToService;
+    denied;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.passedToService = properties.passedToService;
+        this.denied = properties.denied ?? accessDenied;
+    }
+    /**
+     * Ensure the caller may hand this Role to the service.
+     *
+     * A request naming no Role passes nothing and is left alone. That covers an
+     * optional Role, such as the one an update request omits to keep the Role
+     * already in place, and saves each call site repeating the check.
+     */
+    authorize(roleArn, caller) {
+        if (roleArn === undefined) {
+            return;
+        }
+        const decision = this.iam.authorize({
+            action: passRoleAction,
+            resource: roleArn,
+            conditionContext: { [passedToServiceKey]: this.passedToService },
+            caller,
+        });
+        if (decision.isDenied) {
+            throw this.denied({
+                principal: decision.caller.principal,
+                roleArn,
+                reason: decision.denialReason,
+            });
+        }
+    }
+    /**
+     * Ensure the caller may hand every one of these Roles to the service.
+     *
+     * A Firehose delivery stream carrying a Role for its destination beside one
+     * for its source is what this is for. Each Role is its own question, and the
+     * first refusal is the one reported.
+     */
+    authorizeAll(roleArns, caller) {
+        for (const roleArn of roleArns) {
+            this.authorize(roleArn, caller);
+        }
+    }
+}
+/**
+ * Report a refused Role as the shared IAM AccessDenied.
+ */
+function accessDenied(denial) {
+    return new SimIamAccessDenied({
+        principal: denial.principal,
+        reason: denial.reason,
+        action: passRoleAction,
+        resource: denial.roleArn,
+    });
+}
+/**
+ * The message a service reports a refused Role with, in AWS's wording.
+ *
+ * A service reporting denials as its own error type builds its message from
+ * this, so a refused Role reads the same however it is reported.
+ */
+export function simIamPassRoleDenialMessage(denial) {
+    const identifier = new SimIamCallerIdentifier().format(denial.principal);
+    return (`User: ${identifier} is not authorized to perform: ${passRoleAction} on ` +
+        `resource: ${denial.roleArn}`);
+}