@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/lambda/function/logging/sim-lambda-function-logging.js

@@ -1,3 +1,4 @@
+import { simLambdaInvokeErrorLine } from "./sim-lambda-invoke-error-log.js";
 import { SimLambdaLogWriter } from "./sim-lambda-log-writer.js";
 import { simLambdaLogGroupName, simLambdaLogStreamName, } from "./sim-lambda-log-stream-name.js";
 /**
@@ -62,7 +63,7 @@ export class SimLambdaFunctionLogging {
     }
     /**
      * Run an invocation, recording whatever it left unterminated once it is
-     * over.
+     * over, and the error it ended in when it ended in one.
      *
      * The flush happens whether the handler returned or threw, because a handler
      * that logged and then failed is the one a test most wants to read the logs
@@ -72,10 +73,33 @@ export class SimLambdaFunctionLogging {
         try {
             return await run();
         }
+        catch (error) {
+            this.recordInvokeError(error);
+            throw error;
+        }
         finally {
             this.#writer?.flush();
         }
     }
+    /**
+     * Record an invocation that ended in an error nothing caught, as real
+     * Lambda's runtime records one.
+     *
+     * The caller still gets the error: an Invoke answers with `FunctionError`
+     * and the trace in its payload as before, and this only puts the same
+     * failure in the place code goes looking for it.
+     */
+    recordInvokeError(error) {
+        const writer = this.#writer;
+        if (writer === undefined) {
+            return;
+        }
+        // Whatever the handler wrote without closing the line is a line of its
+        // own. A handler that printed half a line before failing would otherwise
+        // have the error appended to it, where a filter for the error misses it.
+        writer.flush();
+        writer.write(simLambdaInvokeErrorLine(error));
+    }
     coldStart() {
         const logStreamName = simLambdaLogStreamName(this.#clock);
         const logs = this.#logs;

package/dist/service/lambda/function/logging/sim-lambda-invoke-error-log.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What real Lambda writes to a function's log group when an invocation ends in
+ * an error nothing caught.
+ *
+ * The runtime prints `ERROR Invoke Error` and a JSON document holding the
+ * error's type, its message and its stack, one array element per frame. The
+ * whole document is one line. CloudWatch Logs records a line as an event, so a
+ * filter matching the message finds every frame with it.
+ *
+ * The keys are the ones the runtime uses. The log line says `stack` where the
+ * Invoke response payload says `trace`, and the two hold the same frames.
+ */
+export declare function simLambdaInvokeErrorLine(error: unknown): string;

package/dist/service/lambda/function/logging/sim-lambda-invoke-error-log.js

@@ -0,0 +1,18 @@
+import { functionErrorDocument } from "../../command/invoke/invoke-payload.js";
+/**
+ * What real Lambda writes to a function's log group when an invocation ends in
+ * an error nothing caught.
+ *
+ * The runtime prints `ERROR Invoke Error` and a JSON document holding the
+ * error's type, its message and its stack, one array element per frame. The
+ * whole document is one line. CloudWatch Logs records a line as an event, so a
+ * filter matching the message finds every frame with it.
+ *
+ * The keys are the ones the runtime uses. The log line says `stack` where the
+ * Invoke response payload says `trace`, and the two hold the same frames.
+ */
+export function simLambdaInvokeErrorLine(error) {
+    const { errorType, errorMessage, trace } = functionErrorDocument(error);
+    const document = JSON.stringify({ errorType, errorMessage, stack: trace });
+    return `ERROR Invoke Error ${document}\n`;
+}

package/dist/service/lambda/sim-lambda-service-principal.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The service principal Lambda holds an execution role as.
+ *
+ * An execution role's trust policy names it, and so does the
+ * `iam:PassedToService` condition a deploy policy is commonly written with.
+ */
+export declare const simLambdaServicePrincipal = "lambda.amazonaws.com";

package/dist/service/lambda/sim-lambda-service-principal.js

@@ -0,0 +1,7 @@
+/**
+ * The service principal Lambda holds an execution role as.
+ *
+ * An execution role's trust policy names it, and so does the
+ * `iam:PassedToService` condition a deploy policy is commonly written with.
+ */
+export const simLambdaServicePrincipal = "lambda.amazonaws.com";

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-authorization.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimLogsAuthorizer } from "../../command/authorize/sim-logs-authorizer.js";
+interface SimCfnDeliveryAuthorizationProperties {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The permissions a CloudFormation delivery Resource handler checks on top of
+ * the API call it makes.
+ *
+ * Each of the three handlers reads its own resource back by name, with
+ * `GetDeliverySource`, `GetDeliveryDestination` or `GetDelivery`. The read
+ * comes before the write, and an execution Role denied it is refused before the
+ * resource exists. The three `Describe` listings belong to the SDK operations
+ * of those names, and no handler goes near one. A policy written from a real
+ * CloudFormation refusal therefore grants the `Get` action, and that policy has
+ * to deploy here.
+ *
+ * The checks sit together because they are the whole of what a deployment's
+ * caller meets before the delivery commands take over.
+ */
+export declare class SimCfnDeliveryAuthorization {
+    #private;
+    constructor(properties: SimCfnDeliveryAuthorizationProperties);
+    /**
+     * Authorize creating an AWS::Logs::DeliverySource.
+     *
+     * The source need not be there. CloudFormation reads the name it is about to
+     * take, and IAM decides the request before CloudWatch Logs answers it.
+     */
+    authorizeDeliverySourceCreate(name: string, caller?: SimAwsCaller): void;
+    /**
+     * Authorize creating an AWS::Logs::DeliveryDestination.
+     */
+    authorizeDeliveryDestinationCreate(name: string, caller?: SimAwsCaller): void;
+    /**
+     * Authorize creating an AWS::Logs::Delivery.
+     *
+     * A delivery carries an identifier CloudWatch Logs has yet to issue. The read
+     * is authorized against every delivery in the scope, the way `CreateDelivery`
+     * itself is.
+     */
+    authorizeDeliveryCreate(caller?: SimAwsCaller): void;
+}
+export {};

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-authorization.js

@@ -0,0 +1,49 @@
+import { simLogsAnyDeliveryArn, simLogsDeliveryDestinationArn, simLogsDeliverySourceArn, } from "../../delivery/sim-logs-delivery-arn.js";
+/**
+ * The permissions a CloudFormation delivery Resource handler checks on top of
+ * the API call it makes.
+ *
+ * Each of the three handlers reads its own resource back by name, with
+ * `GetDeliverySource`, `GetDeliveryDestination` or `GetDelivery`. The read
+ * comes before the write, and an execution Role denied it is refused before the
+ * resource exists. The three `Describe` listings belong to the SDK operations
+ * of those names, and no handler goes near one. A policy written from a real
+ * CloudFormation refusal therefore grants the `Get` action, and that policy has
+ * to deploy here.
+ *
+ * The checks sit together because they are the whole of what a deployment's
+ * caller meets before the delivery commands take over.
+ */
+export class SimCfnDeliveryAuthorization {
+    #authorizer;
+    #scope;
+    constructor(properties) {
+        this.#authorizer = properties.authorizer;
+        this.#scope = properties.accountRegionScope;
+    }
+    /**
+     * Authorize creating an AWS::Logs::DeliverySource.
+     *
+     * The source need not be there. CloudFormation reads the name it is about to
+     * take, and IAM decides the request before CloudWatch Logs answers it.
+     */
+    authorizeDeliverySourceCreate(name, caller) {
+        this.#authorizer.authorizeResource("logs:GetDeliverySource", simLogsDeliverySourceArn(this.#scope, name), caller);
+    }
+    /**
+     * Authorize creating an AWS::Logs::DeliveryDestination.
+     */
+    authorizeDeliveryDestinationCreate(name, caller) {
+        this.#authorizer.authorizeResource("logs:GetDeliveryDestination", simLogsDeliveryDestinationArn(this.#scope, name), caller);
+    }
+    /**
+     * Authorize creating an AWS::Logs::Delivery.
+     *
+     * A delivery carries an identifier CloudWatch Logs has yet to issue. The read
+     * is authorized against every delivery in the scope, the way `CreateDelivery`
+     * itself is.
+     */
+    authorizeDeliveryCreate(caller) {
+        this.#authorizer.authorizeResource("logs:GetDelivery", simLogsAnyDeliveryArn(this.#scope), caller);
+    }
+}

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDelivery } from "../../delivery/sim-logs-delivery.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliveryCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated deliveries from AWS::Logs::Delivery Resources.
@@ -12,6 +14,9 @@ interface SimCfnDeliveryCreatorProperties {
  * A delivery is the join between a source and a destination, and both have to
  * be deployed before it. A template gets that ordering from naming them
  * through `Ref` and `Fn::GetAtt`.
+ *
+ * The handler reads deliveries back before it creates one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDelivery` for.
  */
 export declare class SimCfnDeliveryCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-creator.js

@@ -17,11 +17,16 @@ const actedOnProperties = new Set([
  * A delivery is the join between a source and a destination, and both have to
  * be deployed before it. A template gets that ordering from naming them
  * through `Ref` and `Fn::GetAtt`.
+ *
+ * The handler reads deliveries back before it creates one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDelivery` for.
  */
 export class SimCfnDeliveryCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery from an AWS::Logs::Delivery Resource.
@@ -35,6 +40,7 @@ export class SimCfnDeliveryCreator {
             unsimulatedReasons: deliveryUnsimulatedReasons,
         });
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliveryCreate(options?.caller);
         const created = await this.#logs.createDelivery({ input: simCfnDeliveryInput(reader) }, options);
         const delivery = this.#logs.findDelivery(created.delivery?.id ?? "");
         assertDefined(delivery, `sim CloudWatch Logs delivery for CloudFormation Resource ${resource.logicalId}`);

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-destination-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDeliveryDestination } from "../../delivery/sim-logs-delivery-destination.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliveryDestinationCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated delivery destinations from AWS::Logs::DeliveryDestination
@@ -14,6 +16,9 @@ interface SimCfnDeliveryDestinationCreatorProperties {
  * changes it replaces the Resource. Sim CloudFormation replaces a Resource
  * whose template entry changed at all, which lands on the same behaviour
  * without the destination having to say so.
+ *
+ * The handler reads the destination back before it puts one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDeliveryDestination` for.
  */
 export declare class SimCfnDeliveryDestinationCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-destination-creator.js

@@ -15,11 +15,16 @@ const actedOnProperties = new Set([
  * changes it replaces the Resource. Sim CloudFormation replaces a Resource
  * whose template entry changed at all, which lands on the same behaviour
  * without the destination having to say so.
+ *
+ * The handler reads the destination back before it puts one, and that read is
+ * what a CloudFormation execution Role needs `logs:GetDeliveryDestination` for.
  */
 export class SimCfnDeliveryDestinationCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery destination from a CloudFormation Resource.
@@ -34,6 +39,7 @@ export class SimCfnDeliveryDestinationCreator {
         });
         const name = reader.requiredString("Name");
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliveryDestinationCreate(name, options?.caller);
         await this.#logs.putDeliveryDestination({
             input: {
                 name,

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-source-creator.d.ts

@@ -3,8 +3,10 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 import type { SimLogsDeliverySource } from "../../delivery/sim-logs-delivery-source.js";
 import type { SimLogs } from "../../sim-logs.js";
 import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnDeliveryAuthorization } from "./sim-cfn-delivery-authorization.js";
 interface SimCfnDeliverySourceCreatorProperties {
     readonly logs: SimLogs;
+    readonly authorization: SimCfnDeliveryAuthorization;
 }
 /**
  * Creates simulated delivery sources from AWS::Logs::DeliverySource Resources.
@@ -13,6 +15,9 @@ interface SimCfnDeliverySourceCreatorProperties {
  * store, so a template hits the same refusals an SDK caller would: a
  * distribution that already has a delivery source, and a CloudFront source
  * declared in a stack outside us-east-1.
+ *
+ * The handler reads the source back before it puts one, and that read is what
+ * a CloudFormation execution Role needs `logs:GetDeliverySource` for.
  */
 export declare class SimCfnDeliverySourceCreator {
     #private;

package/dist/service/logs/cfn/delivery/sim-cfn-delivery-source-creator.js

@@ -10,11 +10,16 @@ const actedOnProperties = new Set(["Name", "ResourceArn", "LogType"]);
  * store, so a template hits the same refusals an SDK caller would: a
  * distribution that already has a delivery source, and a CloudFront source
  * declared in a stack outside us-east-1.
+ *
+ * The handler reads the source back before it puts one, and that read is what
+ * a CloudFormation execution Role needs `logs:GetDeliverySource` for.
  */
 export class SimCfnDeliverySourceCreator {
     #logs;
+    #authorization;
     constructor(properties) {
         this.#logs = properties.logs;
+        this.#authorization = properties.authorization;
     }
     /**
      * Create a delivery source from an AWS::Logs::DeliverySource Resource.
@@ -29,6 +34,7 @@ export class SimCfnDeliverySourceCreator {
         });
         const name = reader.requiredString("Name");
         reader.recordIgnoredProperties();
+        this.#authorization.authorizeDeliverySourceCreate(name, options?.caller);
         await this.#logs.putDeliverySource({
             input: {
                 name,

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimLogsLogGroup } from "../../group/sim-logs-log-group.js";
@@ -15,6 +16,12 @@ interface SimCfnLogGroupCreatorProperties {
  * ordinary for the function to have logged first: real CloudFormation fails
  * that deploy, which is a genuine misconfiguration in an account and pure
  * noise in a test whose function ran during setup.
+ *
+ * The commands are still the ones an SDK caller would have used. The
+ * deployment's caller is authorized for `logs:CreateLogGroup` and
+ * `logs:PutRetentionPolicy`, as it is on a real deploy. A group that is
+ * already there changes what happens after that decision (the refusal is
+ * caught) and never whether one is made.
  */
 export declare class SimCfnLogGroupCreator {
     #private;
@@ -22,12 +29,12 @@ export declare class SimCfnLogGroupCreator {
     /**
      * Create a log group from an AWS::Logs::LogGroup Resource.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimLogsLogGroup;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): Promise<SimLogsLogGroup>;
     /**
      * Delete a log group created from an AWS::Logs::LogGroup Resource.
      *
      * The events go with it, as they do in an account.
      */
-    delete(group: SimLogsLogGroup): void;
+    delete(group: SimLogsLogGroup, options?: SimCfnResourceCallerOptions): Promise<void>;
 }
 export {};

package/dist/service/logs/cfn/group/sim-cfn-log-group-creator.js

@@ -1,3 +1,5 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimLogsResourceAlreadyExistsException } from "../../error/sim-logs.error.js";
 import { SimCfnLogGroupProperties } from "./sim-cfn-log-group-properties.js";
 /**
  * Creates simulated log groups from AWS::Logs::LogGroup Resources.
@@ -9,6 +11,12 @@ import { SimCfnLogGroupProperties } from "./sim-cfn-log-group-properties.js";
  * ordinary for the function to have logged first: real CloudFormation fails
  * that deploy, which is a genuine misconfiguration in an account and pure
  * noise in a test whose function ran during setup.
+ *
+ * The commands are still the ones an SDK caller would have used. The
+ * deployment's caller is authorized for `logs:CreateLogGroup` and
+ * `logs:PutRetentionPolicy`, as it is on a real deploy. A group that is
+ * already there changes what happens after that decision (the refusal is
+ * caught) and never whether one is made.
  */
 export class SimCfnLogGroupCreator {
     #logs;
@@ -18,7 +26,7 @@ export class SimCfnLogGroupCreator {
     /**
      * Create a log group from an AWS::Logs::LogGroup Resource.
      */
-    create(resource, properties) {
+    async create(resource, properties, options) {
         const logGroupProperties = new SimCfnLogGroupProperties({
             resource,
             properties,
@@ -26,8 +34,12 @@ export class SimCfnLogGroupCreator {
         const logGroupName = logGroupProperties.logGroupName();
         const retentionInDays = logGroupProperties.retentionInDays();
         logGroupProperties.recordIgnoredProperties();
-        const group = this.#logs.serviceWriter().logGroup(logGroupName);
-        group.setRetention(retentionInDays);
+        await this.#createOrAdopt(logGroupName, options);
+        if (retentionInDays !== undefined) {
+            await this.#logs.putRetentionPolicy({ input: { logGroupName, retentionInDays } }, options);
+        }
+        const group = this.#logs.findLogGroup(logGroupName);
+        assertDefined(group, `sim log group ${logGroupName} after CloudFormation creation`);
         return group;
     }
     /**
@@ -35,7 +47,24 @@ export class SimCfnLogGroupCreator {
      *
      * The events go with it, as they do in an account.
      */
-    delete(group) {
-        this.#logs.serviceWriter().deleteLogGroup(group.logGroupName);
+    async delete(group, options) {
+        await this.#logs.deleteLogGroup({ input: { logGroupName: group.logGroupName } }, options);
+    }
+    /**
+     * Make the log group, or leave the one already under that name where it is.
+     *
+     * The refusal is the one `CreateLogGroup` answers a taken name with. It is
+     * raised after the caller has been authorized. A deployment denied
+     * `logs:CreateLogGroup` therefore fails whether or not the group is there.
+     */
+    async #createOrAdopt(logGroupName, options) {
+        try {
+            await this.#logs.createLogGroup({ input: { logGroupName } }, options);
+        }
+        catch (error) {
+            if (!(error instanceof SimLogsResourceAlreadyExistsException)) {
+                throw error;
+            }
+        }
     }
 }

package/dist/service/logs/cfn/sim-logs-cfn-resource-deleter.js

@@ -17,7 +17,7 @@ export class SimLogsCfnResourceDeleter {
     async delete(resourceTypeName, resource, options) {
         switch (resourceTypeName) {
             case "LogGroup": {
-                this.#creators.logGroups.delete(created(resource));
+                await this.#creators.logGroups.delete(created(resource), options);
                 return;
             }
             case "DeliverySource": {

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.d.ts

@@ -1,8 +1,12 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimLogsAuthorizer } from "../command/authorize/sim-logs-authorizer.js";
 import type { SimLogs } from "../sim-logs.js";
 interface SimLogsCfnResourceFactoryProperties {
     readonly logs: SimLogs;
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
 }
 /**
  * CloudFormation Resource factory for simulated CloudWatch Logs resources.

package/dist/service/logs/cfn/sim-logs-cfn-resource-factory.js

@@ -1,4 +1,5 @@
 import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { SimCfnDeliveryAuthorization } from "./delivery/sim-cfn-delivery-authorization.js";
 import { SimCfnDeliveryCreator } from "./delivery/sim-cfn-delivery-creator.js";
 import { SimCfnDeliveryDestinationCreator } from "./delivery/sim-cfn-delivery-destination-creator.js";
 import { SimCfnDeliverySourceCreator } from "./delivery/sim-cfn-delivery-source-creator.js";
@@ -24,10 +25,14 @@ export class SimLogsCfnResourceFactory {
     #deliveries;
     #deleter;
     constructor(properties) {
+        const delivery = {
+            logs: properties.logs,
+            authorization: new SimCfnDeliveryAuthorization(properties),
+        };
         this.#logGroups = new SimCfnLogGroupCreator(properties);
-        this.#deliverySources = new SimCfnDeliverySourceCreator(properties);
-        this.#deliveryDestinations = new SimCfnDeliveryDestinationCreator(properties);
-        this.#deliveries = new SimCfnDeliveryCreator(properties);
+        this.#deliverySources = new SimCfnDeliverySourceCreator(delivery);
+        this.#deliveryDestinations = new SimCfnDeliveryDestinationCreator(delivery);
+        this.#deliveries = new SimCfnDeliveryCreator(delivery);
         this.#deleter = new SimLogsCfnResourceDeleter({
             logGroups: this.#logGroups,
             deliverySources: this.#deliverySources,
@@ -44,7 +49,7 @@ export class SimLogsCfnResourceFactory {
         const options = simCfnResourceCallerOptions(context.caller);
         switch (resourceTypeName) {
             case "LogGroup": {
-                return this.#logGroups.create(resource, values);
+                return await this.#logGroups.create(resource, values, options);
             }
             case "DeliverySource": {
                 return await this.#deliverySources.create(resource, values, options);

package/dist/service/logs/command/delivery/sim-logs-delivery-source-commands.d.ts

@@ -22,10 +22,12 @@ export declare class SimLogsDeliverySourceCommands {
      * Put a delivery source over a resource whose logs are to be delivered.
      *
      * The service is read from the resource ARN, as real CloudWatch Logs reads
-     * it, and the region the request was made in has to be one that service's
-     * delivery can be set up from. The ARN is then resolved to a resource the
-     * account holds. A source over a distribution the account never created
-     * fails here, ahead of the delivery that would have carried nothing.
+     * it. The caller is then checked against that service as well, because
+     * delivering a resource's logs is a permission the service owning it holds.
+     * The region the request was made in has to be one that service's delivery
+     * can be set up from, and the ARN is then resolved to a resource the account
+     * holds. A source over a distribution the account never created fails here,
+     * ahead of the delivery that would have carried nothing.
      */
     putDeliverySource(command: SimPutDeliverySourceCommand, options?: SimLogsRequestOptions): SimPutDeliverySourceCommandOutput;
     /**

package/dist/service/logs/command/delivery/sim-logs-delivery-source-commands.js

@@ -1,3 +1,4 @@
+import { authorizeSimLogsVendedLogDelivery } from "../../delivery/cloudfront/sim-logs-vended-log-delivery.js";
 import { simLogsAnyDeliverySourceArn, simLogsDeliverySourceArn, } from "../../delivery/sim-logs-delivery-arn.js";
 import { requireSimLogsDeliverySource, requiredSimLogsDeliveredService, } from "../../delivery/sim-logs-delivery-source-service.js";
 import { SimLogsDeliverySource } from "../../delivery/sim-logs-delivery-source.js";
@@ -28,10 +29,12 @@ export class SimLogsDeliverySourceCommands {
      * Put a delivery source over a resource whose logs are to be delivered.
      *
      * The service is read from the resource ARN, as real CloudWatch Logs reads
-     * it, and the region the request was made in has to be one that service's
-     * delivery can be set up from. The ARN is then resolved to a resource the
-     * account holds. A source over a distribution the account never created
-     * fails here, ahead of the delivery that would have carried nothing.
+     * it. The caller is then checked against that service as well, because
+     * delivering a resource's logs is a permission the service owning it holds.
+     * The region the request was made in has to be one that service's delivery
+     * can be set up from, and the ARN is then resolved to a resource the account
+     * holds. A source over a distribution the account never created fails here,
+     * ahead of the delivery that would have carried nothing.
      */
     putDeliverySource(command, options) {
         const input = command.input;
@@ -41,6 +44,12 @@ export class SimLogsDeliverySourceCommands {
         refuseUnsimulatedDeliveryTags(input.tags, "PutDeliverySource");
         this.#authorizer.authorizeResource("logs:PutDeliverySource", simLogsDeliverySourceArn(this.#scope, name), options?.caller);
         const service = requiredSimLogsDeliveredService(resourceArn);
+        authorizeSimLogsVendedLogDelivery({
+            authorizer: this.#authorizer,
+            service,
+            resourceArn,
+            caller: options?.caller,
+        });
         requireSimLogsDeliverySource({
             service,
             regionName: this.#scope.regionName,

package/dist/service/logs/delivery/cloudfront/sim-logs-vended-log-delivery.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimLogsAuthorizer } from "../../command/authorize/sim-logs-authorizer.js";
+interface SimLogsVendedLogDeliveryAuthorization {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly service: string;
+    readonly resourceArn: string;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Authorize delivering the logs of the resource a delivery source names.
+ *
+ * Creating a delivery source calls CloudWatch Logs, and CloudWatch Logs then
+ * checks the caller against the service that owns the resource being logged.
+ * A policy is usually written by asking which service owns the resource type,
+ * and that question gives the wrong answer here. A caller allowed every
+ * `logs:` action and denied CloudFront outright is refused.
+ *
+ * CloudFront is the one delivered service checked, because it is the one the
+ * simulation can name a resource of. A source over an ARN of any other service
+ * carries on as it always did.
+ */
+export declare function authorizeSimLogsVendedLogDelivery(properties: SimLogsVendedLogDeliveryAuthorization): void;
+export {};

package/dist/service/logs/delivery/cloudfront/sim-logs-vended-log-delivery.js

@@ -0,0 +1,28 @@
+import { simLogsCloudFrontDeliveryService } from "../sim-logs-delivery-source-service.js";
+/**
+ * The CloudFront action a delivery source over a distribution is checked for.
+ *
+ * CloudFront names it and nobody calls it. It exists so that setting up
+ * delivery from a distribution is a permission of its own, held apart from
+ * everything else a caller may do to that distribution.
+ */
+const simLogsVendedLogDeliveryAction = "cloudfront:AllowVendedLogDeliveryForResource";
+/**
+ * Authorize delivering the logs of the resource a delivery source names.
+ *
+ * Creating a delivery source calls CloudWatch Logs, and CloudWatch Logs then
+ * checks the caller against the service that owns the resource being logged.
+ * A policy is usually written by asking which service owns the resource type,
+ * and that question gives the wrong answer here. A caller allowed every
+ * `logs:` action and denied CloudFront outright is refused.
+ *
+ * CloudFront is the one delivered service checked, because it is the one the
+ * simulation can name a resource of. A source over an ARN of any other service
+ * carries on as it always did.
+ */
+export function authorizeSimLogsVendedLogDelivery(properties) {
+    if (properties.service !== simLogsCloudFrontDeliveryService) {
+        return;
+    }
+    properties.authorizer.authorizeResource(simLogsVendedLogDeliveryAction, properties.resourceArn, properties.caller);
+}

package/dist/service/logs/sim-logs-commands.d.ts

@@ -1,6 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimLogsAuthorizer } from "./command/authorize/sim-logs-authorizer.js";
 import { SimLogsDeliveryCommands } from "./command/delivery/sim-logs-delivery-commands.js";
 import { SimLogsDeliveryDestinationCommands } from "./command/delivery/sim-logs-delivery-destination-commands.js";
 import { SimLogsDeliverySourceCommands } from "./command/delivery/sim-logs-delivery-source-commands.js";
@@ -45,6 +46,8 @@ export interface SimLogsProperties {
  * somewhere it is not competing for room with them.
  */
 export declare class SimLogsCommands {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly groups: SimLogsLogGroupStore;
     readonly logGroups: SimLogsLogGroupCommands;
     readonly retention: SimLogsRetentionCommands;

package/dist/service/logs/sim-logs-commands.js

@@ -30,6 +30,8 @@ import { SimLogsServiceWriter } from "./write/sim-logs-service-writer.js";
  * somewhere it is not competing for room with them.
  */
 export class SimLogsCommands {
+    authorizer;
+    accountRegionScope;
     groups;
     logGroups;
     retention;
@@ -58,6 +60,8 @@ export class SimLogsCommands {
             accountRegionScope,
             background,
         });
+        this.authorizer = authorizer;
+        this.accountRegionScope = accountRegionScope;
         this.background = background;
         this.groups = groups;
         this.fanOut = fanOut;