@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -2,11 +2,12 @@ import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
-import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
@@ -23,6 +24,13 @@ interface SimIamAccountAuthZProperties {
      * Left out, such a request is decided as this Account's root principal.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A run-as block says who is making the requests inside it, which outranks
+     * what the simulation holds for its unattributed requests generally.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     /**
      * Resolves other Accounts' IAM in the same simulation.
      *
@@ -43,10 +51,11 @@ interface SimIamAccountAuthZProperties {
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the simulation's default
- * caller, and to the root principal of the owning sim Account where the
- * simulation has none. An explicit anonymous caller suppresses both and is
- * evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the ambient caller of the
+ * run-as block the request is inside, then to the simulation's default caller,
+ * and to the root principal of the owning sim Account where there is neither.
+ * An explicit anonymous caller suppresses all three and is evaluated without
+ * identity policies.
  */
 export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -3,10 +3,11 @@ import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
  * Evaluates IAM authorization attempts against one simulated Account's IAM
  * state.
  *
- * If the caller is omitted, authorization defaults to the simulation's default
- * caller, and to the root principal of the owning sim Account where the
- * simulation has none. An explicit anonymous caller suppresses both and is
- * evaluated without identity policies.
+ * If the caller is omitted, authorization defaults to the ambient caller of the
+ * run-as block the request is inside, then to the simulation's default caller,
+ * and to the root principal of the owning sim Account where there is neither.
+ * An explicit anonymous caller suppresses all three and is evaluated without
+ * identity policies.
  */
 export class SimIamAccountAuthZ {
     properties;
@@ -40,6 +41,7 @@ export class SimIamAccountAuthZ {
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
             defaultCaller: this.properties.defaultCaller,
+            ambientCaller: this.properties.ambientCaller,
             iamResolver: this.properties.iamResolver,
             scpResolver: this.properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -1,11 +1,12 @@
 import type { SimArn } from "../../aws/arn.js";
 import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
-import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsDefaultCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAmbientCaller } from "../../aws/caller/sim-aws-ambient-caller.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
@@ -18,6 +19,7 @@ interface SimIamAuthorizerProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
     readonly iamResolver?: SimIamAccountResolver | undefined;
     readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -1,4 +1,4 @@
-import { SimIamAuthZContextBuilder, } from "./context/sim-iam-auth-z-context-builder.js";
+import { SimIamAuthZContextBuilder } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 /**
  * Facade for simulated IAM authorization decisions.
@@ -18,6 +18,7 @@ export class SimIamAuthorizer {
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
             iamResolver: properties.iamResolver,
             scpResolver: properties.scpResolver,
         });

package/dist/service/iam/authorize/sim-iam-inter-service-auth-z.d.ts

@@ -1,4 +1,4 @@
-import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-input.js";
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 /**
  * The part of an IAM authorization decision needed by service integrations.

package/dist/service/iam/authorize/sim-iam-wildcard.js

@@ -1,12 +1,48 @@
+import { BoundedMemo } from "../../../util/memo/bounded-memo.js";
+/**
+ * How many compiled patterns to keep, for each of the two case sensitivities.
+ *
+ * One realistic organization policy set produces fewer than a hundred distinct
+ * patterns, and every request evaluates the same ones again. A few thousand
+ * leaves room for many documents attached at once, and holds a few thousand
+ * small regular expressions at worst.
+ */
+const compiledPatternLimit = 2000;
+/*
+ * Wildcard patterns already turned into regular expressions, held in a store
+ * per case sensitivity so that a lookup needs no key built for it.
+ *
+ * A pattern's text and its case sensitivity decide the whole of what is
+ * compiled. An entry made while evaluating one simulation's policies is the
+ * entry another simulation would have made for itself. A compiled expression
+ * also carries nothing from one use to the next, because the flags below leave
+ * out "g" and "y", and `test` keeps a position only under those. These stores
+ * therefore last as long as the process does, and a `SimAws` that goes out of
+ * scope leaves them behind for the next one.
+ */
+const caseSensitivePatterns = new BoundedMemo(compiledPatternLimit);
+const caseInsensitivePatterns = new BoundedMemo(compiledPatternLimit);
 /**
  * Match an IAM-style wildcard pattern.
  *
  * "*" means zero or more characters and "?" means exactly one character.
  */
 export function simIamWildcardMatch(pattern, value, options) {
-    return wildcardMatch(pattern, value, options);
+    return patternRegExp(pattern, options.caseSensitive).test(value);
 }
-function wildcardMatch(pattern, value, options) {
+/**
+ * The regular expression a pattern compiles to, compiling it the first time it
+ * is asked for and reusing it afterwards.
+ */
+function patternRegExp(pattern, caseSensitive) {
+    return caseSensitive
+        ? caseSensitivePatterns.getOrCreate(pattern, () => compilePattern(pattern, "u"))
+        : caseInsensitivePatterns.getOrCreate(pattern, () => compilePattern(pattern, "iu"));
+}
+/**
+ * Turn a wildcard pattern into the regular expression that matches it.
+ */
+function compilePattern(pattern, flags) {
     const regexPattern = pattern
         .replaceAll(/[\\^$.*+?()[\]{}|]/gu, String.raw `\$&`)
         .replaceAll(String.raw `\*`, ".*")
@@ -17,6 +53,5 @@ function wildcardMatch(pattern, value, options) {
      * other regex characters are escaped above.
      */
     // oxlint-disable-next-line security/detect-non-literal-regexp
-    const regExp = new RegExp(`^${regexPattern}$`, options.caseSensitive ? "u" : "iu");
-    return regExp.test(value);
+    return new RegExp(`^${regexPattern}$`, flags);
 }

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -1,4 +1,5 @@
 import { SimCfnIamManagedPolicyAttacher } from "./sim-cfn-iam-managed-policy-attacher.js";
+import { simCfnIamPolicyGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Creates simulated IAM Managed Policies from CloudFormation Resources.
@@ -35,7 +36,7 @@ export class SimCfnIamManagedPolicyCreator {
     managedPolicyName(resource, properties) {
         const managedPolicyName = properties["ManagedPolicyName"];
         if (managedPolicyName === undefined) {
-            return resource.logicalId;
+            return simCfnIamPolicyGeneratedName(resource);
         }
         if (typeof managedPolicyName !== "string") {
             throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ManagedPolicyName must be a string`);

package/dist/service/iam/cfn/name/sim-cfn-iam-generated-name.d.ts

@@ -0,0 +1,16 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+/**
+ * The name CloudFormation gives a Role or a User whose template does not name
+ * it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since IAM keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one an IAM name allows.
+ */
+export declare function simCfnIamPrincipalGeneratedName(resource: SimCfnResource): string;
+/**
+ * The name CloudFormation gives a Managed Policy whose template does not name
+ * it, under the same rules as a Role's but with twice the room.
+ */
+export declare function simCfnIamPolicyGeneratedName(resource: SimCfnResource): string;

package/dist/service/iam/cfn/name/sim-cfn-iam-generated-name.js

@@ -0,0 +1,36 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+/**
+ * The longest name IAM accepts for a Role or a User. Both take the same
+ * length.
+ *
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
+ */
+const maximumPrincipalNameLength = 64;
+/** The longest name IAM accepts for a Policy, twice what a Role takes. */
+const maximumPolicyNameLength = 128;
+/**
+ * The name CloudFormation gives a Role or a User whose template does not name
+ * it.
+ *
+ * Sixty-four characters is short for a name made of a stack name and a logical
+ * ID, so `SimCfnGeneratedResourceName` usually has to trim one. The case is
+ * left alone, since IAM keeps a name as it was given, and every character a
+ * stack name or a logical ID is made of is one an IAM name allows.
+ */
+export function simCfnIamPrincipalGeneratedName(resource) {
+    return generatedName(resource, maximumPrincipalNameLength);
+}
+/**
+ * The name CloudFormation gives a Managed Policy whose template does not name
+ * it, under the same rules as a Role's but with twice the room.
+ */
+export function simCfnIamPolicyGeneratedName(resource) {
+    return generatedName(resource, maximumPolicyNameLength);
+}
+function generatedName(resource, maximumLength) {
+    return new SimCfnGeneratedResourceName({
+        stackName: resource.stackName,
+        logicalId: resource.logicalId,
+        maximumLength,
+    }).value;
+}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,3 +1,5 @@
+import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
@@ -16,7 +18,7 @@ export class SimCfnIamRolePropertiesParser {
     parse(resource, properties) {
         return {
             roleName: this.optionalString(resource, properties["RoleName"], "RoleName") ??
-                resource.logicalId,
+                simCfnIamPrincipalGeneratedName(resource),
             path: this.optionalString(resource, properties["Path"], "Path"),
             description: this.optionalString(resource, properties["Description"], "Description"),
             assumeRolePolicyDocument: this.jsonObject(resource, properties["AssumeRolePolicyDocument"], "AssumeRolePolicyDocument"),
@@ -25,13 +27,12 @@ export class SimCfnIamRolePropertiesParser {
         };
     }
     optionalString(resource, value, label) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ${label} must be a string`);
-        }
-        return value;
+        return simCfnIamOptionalString({
+            resourceType: "AWS::IAM::Role",
+            resource,
+            value,
+            label,
+        });
     }
     jsonObject(resource, value, label) {
         if (typeof value !== "object" || value === null || Array.isArray(value)) {

package/dist/service/iam/cfn/sim-cfn-iam-optional-string.d.ts

@@ -0,0 +1,17 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnIamOptionalStringProperties {
+    readonly resourceType: string;
+    readonly resource: SimCfnResource;
+    readonly value: SimCfnTemplateValueRecord[string] | undefined;
+    readonly label: string;
+}
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export declare function simCfnIamOptionalString(properties: SimCfnIamOptionalStringProperties): string | undefined;
+export {};

package/dist/service/iam/cfn/sim-cfn-iam-optional-string.js

@@ -0,0 +1,17 @@
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export function simCfnIamOptionalString(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
+    }
+    return value;
+}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-properties-parser.js

@@ -1,3 +1,5 @@
+import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 const resourceType = "AWS::IAM::User";
 /**
@@ -18,7 +20,7 @@ export class SimCfnIamUserPropertiesParser {
         this.rejectGroups(resource, properties);
         return {
             userName: this.optionalString(resource, properties["UserName"], "UserName") ??
-                resource.logicalId,
+                simCfnIamPrincipalGeneratedName(resource),
             path: this.optionalString(resource, properties["Path"], "Path"),
             inlinePolicies: this.policiesParser.inlinePolicies(resource, properties),
             managedPolicyArns: this.policiesParser.managedPolicyArns(resource, properties),
@@ -68,12 +70,6 @@ export class SimCfnIamUserPropertiesParser {
         };
     }
     optionalString(resource, value, label) {
-        if (value === undefined) {
-            return undefined;
-        }
-        if (typeof value !== "string") {
-            throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
-        }
-        return value;
+        return simCfnIamOptionalString({ resourceType, resource, value, label });
     }
 }

package/dist/service/iam/command/policy/create-policy/create-policy-input-resolver.js

@@ -1,6 +1,7 @@
 import { makeSimPolicyArn } from "../../../policy/sim-iam-policy-arn.js";
 import { normalisePolicyPath } from "../../../policy/sim-iam-policy-path.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamManagedPolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * Validates CreatePolicy command input and resolves it into the policy's
  * identity (name, normalised path, and ARN).
@@ -26,6 +27,7 @@ export class CreatePolicyInputResolver {
         if (policyName === undefined || policyName.length === 0) {
             throw new Error("PolicyName is required");
         }
+        assertSimIamManagedPolicyWithinSizeLimit(command.input.PolicyDocument);
         this.policyDocValidator.validateOptional(command.input.PolicyDocument, {
             attachedTo: "Policy",
             name: policyName,

package/dist/service/iam/command/policy/put-role-policy/put-role-policy.handler.js

@@ -1,6 +1,7 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamInlinePolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * IAM PutRolePolicyCommand handler.
  *
@@ -33,6 +34,10 @@ export class PutRolePolicyCommandHandler {
             throw new Error("PolicyName is required");
         }
         const policyDocument = command.input.PolicyDocument;
+        assertSimIamInlinePolicyWithinSizeLimit(policyDocument, {
+            kind: "role",
+            name: roleName,
+        });
         this.policyDocValidator.validateRequired(policyDocument, {
             attachedTo: "Role",
             name: roleName,

package/dist/service/iam/command/policy/put-user-policy/put-user-policy.handler.js

@@ -1,6 +1,7 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
 import { SimIamPolicyDocumentValidator } from "../../../validate/sim-iam-policy-document-validator.js";
+import { assertSimIamInlinePolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 import { assertDefined } from "../../../../../util/type-guard/defined.js";
 /**
  * IAM PutUserPolicyCommand handler.
@@ -29,6 +30,10 @@ export class PutUserPolicyCommandHandler {
         const policyName = command.input.PolicyName;
         assertDefined(policyName, "PutUserPolicyCommand.input.PolicyName");
         const policyDocument = command.input.PolicyDocument;
+        assertSimIamInlinePolicyWithinSizeLimit(policyDocument, {
+            kind: "user",
+            name: username,
+        });
         this.policyDocValidator.validateRequired(policyDocument, {
             attachedTo: "User",
             name: username,

package/dist/service/iam/command/role/create-role/create-role.handler.js

@@ -4,6 +4,7 @@ import { SimIamEntityAlreadyExists } from "../../../error/sim-iam.error.js";
 import { normaliseRolePath } from "../../../role/sim-iam-role-path.js";
 import { makeSimRoleArn } from "../../../role/arn/sim-iam-role-arn.js";
 import { SimIamTrustPolicyDocumentValidator } from "../../../validate/trust/sim-iam-trust-policy-document-validator.js";
+import { assertSimIamTrustPolicyWithinSizeLimit } from "../../../validate/size/sim-iam-policy-document-size.js";
 /**
  * IAM CreateRoleCommand handler.
  *
@@ -34,7 +35,9 @@ export class CreateRoleCommandHandler {
         if (roleName === undefined || roleName.length === 0) {
             throw new Error("RoleName is required");
         }
-        this.trustPolicyValidator.validateRequired(command.input.AssumeRolePolicyDocument);
+        const trustPolicyDocument = command.input.AssumeRolePolicyDocument;
+        assertSimIamTrustPolicyWithinSizeLimit(trustPolicyDocument, roleName);
+        this.trustPolicyValidator.validateRequired(trustPolicyDocument);
         const path = normaliseRolePath(command.input.Path);
         const arn = makeSimRoleArn({
             accountId: this.accountId,

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -84,3 +84,14 @@ export declare class SimIamMalformedPolicyDocument extends SimIamError {
     readonly name = "MalformedPolicyDocument";
     constructor(message: string);
 }
+/**
+ * Simulated IAM LimitExceeded error.
+ *
+ * IAM answers a request that would take the account past one of its quotas
+ * with this, such as a policy document longer than the limit for where it is
+ * going.
+ */
+export declare class SimIamLimitExceeded extends SimIamError {
+    readonly name = "LimitExceeded";
+    constructor(message: string);
+}

package/dist/service/iam/error/sim-iam.error.js

@@ -83,3 +83,16 @@ export class SimIamMalformedPolicyDocument extends SimIamError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated IAM LimitExceeded error.
+ *
+ * IAM answers a request that would take the account past one of its quotas
+ * with this, such as a policy document longer than the limit for where it is
+ * going.
+ */
+export class SimIamLimitExceeded extends SimIamError {
+    name = "LimitExceeded";
+    constructor(message) {
+        super(message, { httpStatusCode: 409 });
+    }
+}

package/dist/service/iam/index.d.ts

@@ -2,6 +2,7 @@ export { SimIam } from "./sim-iam.js";
 export type { SimIamConditionValue, SimIamPolicyDocument, SimIamPolicyDocumentCondition, SimIamPolicyDocumentPrincipal, SimIamPolicyDocumentStatement, } from "./policy/sim-iam-policy.js";
 export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
+export type { SimIamDeployRoleInput, SimIamDeployRolePolicy, } from "./role/sim-iam-deploy-role.js";
 export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";

package/dist/service/iam/policy/sim-iam-policy-document-of-size.d.ts

@@ -0,0 +1,18 @@
+import type { SimIamPolicyDocument } from "./sim-iam-policy.js";
+/**
+ * Build a policy document IAM would measure at exactly this many characters.
+ *
+ * A test about IAM's character limits has a size to state rather than a
+ * statement. Padding an ARN leaves a document IAM would otherwise take, so the
+ * size is the only thing the command is being asked about. The size is the one
+ * IAM counts, of the document written compactly, and a caller is free to
+ * indent what it hands over.
+ */
+export declare function simIamPolicyDocumentOfSize(characters: number): SimIamPolicyDocument;
+/**
+ * Build a Role trust policy document of exactly this many characters.
+ *
+ * A trust policy carries a Principal and no Resource, so it is padded through
+ * a Sid instead.
+ */
+export declare function simIamTrustPolicyDocumentOfSize(characters: number): SimIamPolicyDocument;

package/dist/service/iam/policy/sim-iam-policy-document-of-size.js

@@ -0,0 +1,41 @@
+import { jsonStringify } from "../../../util/type-guard/json.js";
+/**
+ * Build a policy document IAM would measure at exactly this many characters.
+ *
+ * A test about IAM's character limits has a size to state rather than a
+ * statement. Padding an ARN leaves a document IAM would otherwise take, so the
+ * size is the only thing the command is being asked about. The size is the one
+ * IAM counts, of the document written compactly, and a caller is free to
+ * indent what it hands over.
+ */
+export function simIamPolicyDocumentOfSize(characters) {
+    return padded(characters, (padding) => ({
+        Version: "2012-10-17",
+        Statement: {
+            Effect: "Allow",
+            Action: "s3:GetObject",
+            Resource: `arn:aws:s3:::reports-bucket/${padding}`,
+        },
+    }));
+}
+/**
+ * Build a Role trust policy document of exactly this many characters.
+ *
+ * A trust policy carries a Principal and no Resource, so it is padded through
+ * a Sid instead.
+ */
+export function simIamTrustPolicyDocumentOfSize(characters) {
+    return padded(characters, (padding) => ({
+        Version: "2012-10-17",
+        Statement: {
+            Sid: padding,
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    }));
+}
+function padded(characters, make) {
+    const unpadded = jsonStringify(make("")).length;
+    return make("x".repeat(characters - unpadded));
+}

package/dist/service/iam/role/sim-iam-deploy-role.d.ts

@@ -0,0 +1,56 @@
+import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimPutRolePolicyCommand, SimPutRolePolicyCommandOutput } from "../command/policy/put-role-policy/put-role-policy.command.js";
+import type { SimCreateRoleCommand, SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+/**
+ * A permissions policy for a deploy Role.
+ *
+ * The parsed document a CDK app answers with, or the JSON string a template,
+ * a file or the SDK carries it as.
+ */
+export type SimIamDeployRolePolicy = SimIamPolicyDocument | string;
+/**
+ * What making a Role for a deployment to run as takes.
+ */
+export interface SimIamDeployRoleInput {
+    /**
+     * The name to create the Role under.
+     */
+    readonly roleName: string;
+    /**
+     * What the deployment is allowed to do.
+     *
+     * Several documents go on the Role as several inline policies. A policy
+     * split in two to stay under IAM's size cap is passed on whole.
+     */
+    readonly policyDocument: SimIamDeployRolePolicy | readonly SimIamDeployRolePolicy[];
+}
+/**
+ * The IAM commands making a deploy Role takes.
+ */
+interface SimIamDeployRoleCommands {
+    createRole(command: SimCreateRoleCommand): Promise<SimCreateRoleCommandOutput>;
+    putRolePolicy(command: SimPutRolePolicyCommand): Promise<SimPutRolePolicyCommandOutput>;
+}
+/**
+ * Makes the Role a simulated CloudFormation deployment runs as.
+ *
+ * A project that scopes its own deploy permissions has the policy document
+ * already and wants a caller to pass to `deployTemplate`, `deployTemplateFile`
+ * or `deployCdkOut`. Getting from one to the other is a Role with the trust
+ * CloudFormation needs, the document on it, and the Role's ARN. The trust is
+ * the same every time and the ARN follows from the name. Neither is asked for.
+ */
+export declare class SimIamDeployRoleMaker {
+    private readonly commands;
+    constructor(commands: SimIamDeployRoleCommands);
+    /**
+     * Create the Role and answer with the caller a deployment names it by.
+     *
+     * Each document goes on as an inline policy of its own, under a numbered
+     * name. A policy split in two to fit IAM's cap has no second name of its
+     * own.
+     */
+    make(input: SimIamDeployRoleInput): Promise<SimArnPrincipal>;
+}
+export {};

package/dist/service/iam/role/sim-iam-deploy-role.js

@@ -0,0 +1,50 @@
+import { jsonStringify } from "../../../util/type-guard/json.js";
+/**
+ * The trust a Role needs for CloudFormation to deploy as it.
+ */
+const deploymentTrustPolicy = jsonStringify({
+    Version: "2012-10-17",
+    Statement: {
+        Effect: "Allow",
+        Principal: { Service: "cloudformation.amazonaws.com" },
+        Action: "sts:AssumeRole",
+    },
+});
+/**
+ * Makes the Role a simulated CloudFormation deployment runs as.
+ *
+ * A project that scopes its own deploy permissions has the policy document
+ * already and wants a caller to pass to `deployTemplate`, `deployTemplateFile`
+ * or `deployCdkOut`. Getting from one to the other is a Role with the trust
+ * CloudFormation needs, the document on it, and the Role's ARN. The trust is
+ * the same every time and the ARN follows from the name. Neither is asked for.
+ */
+export class SimIamDeployRoleMaker {
+    commands;
+    constructor(commands) {
+        this.commands = commands;
+    }
+    /**
+     * Create the Role and answer with the caller a deployment names it by.
+     *
+     * Each document goes on as an inline policy of its own, under a numbered
+     * name. A policy split in two to fit IAM's cap has no second name of its
+     * own.
+     */
+    async make(input) {
+        const creation = await this.commands.createRole({
+            input: {
+                RoleName: input.roleName,
+                AssumeRolePolicyDocument: deploymentTrustPolicy,
+            },
+        });
+        await Promise.all([input.policyDocument].flat().map((document, index) => this.commands.putRolePolicy({
+            input: {
+                RoleName: input.roleName,
+                PolicyName: `${input.roleName}-policy-${index + 1}`,
+                PolicyDocument: typeof document === "string" ? document : jsonStringify(document),
+            },
+        })));
+        return { kind: "arn", arn: creation.Role.Arn };
+    }
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -19,7 +19,9 @@ export interface SimIamRoleWithPolicyInput {
      *
      * A simulation given a default caller attributes these two commands to it,
      * and a Role being created for that caller has no policies to allow them
-     * yet. Naming the Account root here is how such a test bootstraps.
+     * yet. Naming the Account root here is one way for such a test to bootstrap.
+     * Calling inside `simAws.runAs(simAws.account().rootPrincipal, ...)` is the
+     * other, and covers everything else the block does as well.
      */
     readonly caller?: SimAwsCaller | undefined;
 }