@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.d.ts

@@ -7,6 +7,23 @@ import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-
  * rather than `...:parameter//myapp/prod/db-host`.
  */
 export declare function ssmParameterArnPrefix(accountRegionScope: SimAwsAccountRegionScope): string;
+/**
+ * The longest a parameter name may be, counting the ARN that precedes it.
+ *
+ * Real Parameter Store reserves the rest of the 2048 character ARN for its own
+ * use, and counts the ARN prefix towards the 1011 characters left. That is why
+ * this limit needs the Account and Region: the same name is legal in one
+ * Region and too long in another.
+ */
+export declare const maximumSsmParameterArnLength = 1011;
+/**
+ * The longest name a parameter may be given in this Account and Region.
+ *
+ * The ARN prefix comes out of the same allowance the name does, so the room
+ * left for a name depends on how long the Region's name is. A generated name
+ * is trimmed to this so that it is never one PutParameter would then refuse.
+ */
+export declare function maximumSimSsmParameterNameLength(accountRegionScope: SimAwsAccountRegionScope): number;
 interface SimSsmParameterArnProperties {
     readonly resource: string;
     readonly accountRegionScope: SimAwsAccountRegionScope;

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.js

@@ -9,6 +9,26 @@ export function ssmParameterArnPrefix(accountRegionScope) {
     const { regionName, accountId } = accountRegionScope;
     return `arn:aws:ssm:${regionName}:${accountId}:parameter/`;
 }
+/**
+ * The longest a parameter name may be, counting the ARN that precedes it.
+ *
+ * Real Parameter Store reserves the rest of the 2048 character ARN for its own
+ * use, and counts the ARN prefix towards the 1011 characters left. That is why
+ * this limit needs the Account and Region: the same name is legal in one
+ * Region and too long in another.
+ */
+export const maximumSsmParameterArnLength = 1011;
+/**
+ * The longest name a parameter may be given in this Account and Region.
+ *
+ * The ARN prefix comes out of the same allowance the name does, so the room
+ * left for a name depends on how long the Region's name is. A generated name
+ * is trimmed to this so that it is never one PutParameter would then refuse.
+ */
+export function maximumSimSsmParameterNameLength(accountRegionScope) {
+    return (maximumSsmParameterArnLength -
+        ssmParameterArnPrefix(accountRegionScope).length);
+}
 /**
  * The ARN of one simulated parameter.
  *

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -13,15 +13,20 @@ interface SimSsmParameterKmsProperties {
 /**
  * The KMS calls a SecureString parameter makes.
  *
- * The calls are made as the caller rather than as the service, which is the
- * point: under a customer managed key a standard tier write needs
- * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
- * top of the SSM permission for the parameter itself.
+ * The calls are made as the caller rather than as the service. Under a
+ * customer managed key a standard tier write needs `kms:Encrypt` on the key
+ * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
+ * for the parameter itself.
  *
- * They are also made through the service, which is why the `aws/ssm` managed
- * key needs no KMS permission at all: its policy admits the Account's
- * principals when `kms:ViaService` names Systems Manager, and Parameter Store
- * is what supplies that.
+ * They are also made through the service, and passing through it is what
+ * reaches the `aws/ssm` managed key at all. That key's policy allows the
+ * cryptographic actions to a wildcard principal under `kms:ViaService` and
+ * `kms:CallerAccount` conditions, and Parameter Store supplies the first of
+ * them. A grant of that shape delegates nothing to IAM, and it admits the
+ * request by itself. A Role holding `ssm:GetParameter` and nothing on KMS
+ * reads the decrypted value, as it does in an account. A caller in another
+ * Account fails the `kms:CallerAccount` condition, and a caller reaching KMS
+ * directly carries no `kms:ViaService` for the policy to match.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js

@@ -13,15 +13,20 @@ const parameterArnContextKey = "PARAMETER_ARN";
 /**
  * The KMS calls a SecureString parameter makes.
  *
- * The calls are made as the caller rather than as the service, which is the
- * point: under a customer managed key a standard tier write needs
- * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
- * top of the SSM permission for the parameter itself.
+ * The calls are made as the caller rather than as the service. Under a
+ * customer managed key a standard tier write needs `kms:Encrypt` on the key
+ * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
+ * for the parameter itself.
  *
- * They are also made through the service, which is why the `aws/ssm` managed
- * key needs no KMS permission at all: its policy admits the Account's
- * principals when `kms:ViaService` names Systems Manager, and Parameter Store
- * is what supplies that.
+ * They are also made through the service, and passing through it is what
+ * reaches the `aws/ssm` managed key at all. That key's policy allows the
+ * cryptographic actions to a wildcard principal under `kms:ViaService` and
+ * `kms:CallerAccount` conditions, and Parameter Store supplies the first of
+ * them. A grant of that shape delegates nothing to IAM, and it admits the
+ * request by itself. A Role holding `ssm:GetParameter` and nothing on KMS
+ * reads the decrypted value, as it does in an account. A caller in another
+ * Account fails the `kms:CallerAccount` condition, and a caller reaching KMS
+ * directly carries no `kms:ViaService` for the policy to match.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.

package/dist/service/ssm/parameter/sim-ssm-parameter-name.js

@@ -1,17 +1,8 @@
 import { SimSsmHierarchyLevelLimitExceededException, SimSsmParameterPatternMismatchException, SimSsmValidationException, } from "../error/sim-ssm.error.js";
-import { ssmParameterArnPrefix } from "./sim-ssm-parameter-arn.js";
+import { maximumSsmParameterArnLength, ssmParameterArnPrefix, } from "./sim-ssm-parameter-arn.js";
 const allowedCharacters = /^[\w./-]+$/;
 const maxHierarchyLevels = 15;
 const reservedPrefixes = ["aws", "ssm"];
-/**
- * The longest a parameter name may be, counting the ARN that precedes it.
- *
- * Real Parameter Store reserves the rest of the 2048 character ARN for its own
- * use, and counts the ARN prefix towards the 1011 characters left. That is why
- * this limit needs the Account and Region: the same name is legal in one
- * Region and too long in another.
- */
-const maxArnLength = 1011;
 /**
  * The name of one simulated parameter, validated as real Parameter Store
  * validates it.
@@ -106,11 +97,11 @@ export class SimSsmParameterName {
     }
     requireWithinArnLength(accountRegionScope) {
         const arnLength = ssmParameterArnPrefix(accountRegionScope).length + this.resource.length;
-        if (arnLength <= maxArnLength) {
+        if (arnLength <= maximumSsmParameterArnLength) {
             return;
         }
         throw new SimSsmValidationException(`Parameter name '${this.value}' makes an ARN of ${String(arnLength)} ` +
-            `characters; Parameter Store allows ${String(maxArnLength)} ` +
+            `characters; Parameter Store allows ${String(maximumSsmParameterArnLength)} ` +
             `including the ARN prefix for this Account and Region`);
     }
 }

package/dist/service/stepfunctions/command/authorize/sim-step-functions-authorizer.d.ts

@@ -0,0 +1,41 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface SimStepFunctionsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to Step Functions requests.
+ *
+ * A state machine is named by its ARN, and that is the form a Step Functions
+ * policy is written in. `CreateStateMachine` has no ARN to be given. It
+ * authorizes against the one the state machine is about to have, which a
+ * policy naming `stateMachine:orders-*` covers.
+ *
+ * A state machine's `roleArn` is a second question. Step Functions keeps that
+ * Role and runs every execution as it, so the caller creating one needs
+ * `iam:PassRole` on it. The resource there is the Role.
+ */
+export declare class SimStepFunctionsAuthorizer {
+    #private;
+    constructor(properties: SimStepFunctionsAuthorizerProperties);
+    /**
+     * Ensure the caller may hand Step Functions a state machine's role.
+     */
+    authorizePassRole(roleArn: string, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may perform an action on a state machine of this name.
+     */
+    authorizeStateMachineName(action: string, name: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may perform an action on a state machine ARN.
+     *
+     * The state machine need not be there. Real IAM evaluates a request before
+     * the service handles it, so a caller with no permission is refused whether
+     * or not the ARN names anything.
+     */
+    authorizeStateMachineArn(action: string, stateMachineArn: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/stepfunctions/command/authorize/sim-step-functions-authorizer.js

@@ -0,0 +1,64 @@
+import { SimIamPassRoleAuthorizer } from "../../../iam/authorize/pass-role/sim-iam-pass-role-authorizer.js";
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simStateMachineArn } from "../../machine/sim-state-machine-arn.js";
+import { simStatesServicePrincipal } from "../../task/sim-states-execution-role.js";
+/**
+ * Applies simulated IAM authorization to Step Functions requests.
+ *
+ * A state machine is named by its ARN, and that is the form a Step Functions
+ * policy is written in. `CreateStateMachine` has no ARN to be given. It
+ * authorizes against the one the state machine is about to have, which a
+ * policy naming `stateMachine:orders-*` covers.
+ *
+ * A state machine's `roleArn` is a second question. Step Functions keeps that
+ * Role and runs every execution as it, so the caller creating one needs
+ * `iam:PassRole` on it. The resource there is the Role.
+ */
+export class SimStepFunctionsAuthorizer {
+    #iam;
+    #accountRegionScope;
+    #passRole;
+    constructor(properties) {
+        this.#iam = properties.iam;
+        this.#accountRegionScope = properties.accountRegionScope;
+        this.#passRole = new SimIamPassRoleAuthorizer({
+            iam: properties.iam,
+            passedToService: simStatesServicePrincipal,
+        });
+    }
+    /**
+     * Ensure the caller may hand Step Functions a state machine's role.
+     */
+    authorizePassRole(roleArn, caller) {
+        this.#passRole.authorize(roleArn, caller);
+    }
+    /**
+     * Ensure the caller may perform an action on a state machine of this name.
+     */
+    authorizeStateMachineName(action, name, caller) {
+        return this.authorizeStateMachineArn(action, simStateMachineArn(this.#accountRegionScope, name), caller);
+    }
+    /**
+     * Ensure the caller may perform an action on a state machine ARN.
+     *
+     * The state machine need not be there. Real IAM evaluates a request before
+     * the service handles it, so a caller with no permission is refused whether
+     * or not the ARN names anything.
+     */
+    authorizeStateMachineArn(action, stateMachineArn, caller) {
+        const decision = this.#iam.authorize({
+            action,
+            resource: stateMachineArn,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource: stateMachineArn,
+            });
+        }
+        return decision.caller;
+    }
+}

package/dist/service/stepfunctions/command/machine/sim-state-machine-create.d.ts

@@ -1,9 +1,12 @@
 import type { BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimStateMachineStore } from "../../machine/sim-state-machine-store.js";
+import type { SimStepFunctionsAuthorizer } from "../authorize/sim-step-functions-authorizer.js";
+import type { SimStepFunctionsRequestOptions } from "../sim-step-functions-request-options.js";
 import type { SimCreateStateMachineCommand, SimCreateStateMachineCommandOutput } from "./machine.command.js";
 interface SimStateMachineCreateProperties {
     readonly stateMachines: SimStateMachineStore;
+    readonly authorizer: SimStepFunctionsAuthorizer;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly background: BackgroundScheduler;
 }
@@ -22,8 +25,8 @@ export declare class SimStateMachineCreate {
      *
      * `CreateStateMachine` is idempotent. A second request carrying the same
      * name, definition and type answers with the state machine that is already
-     * there.
+     * there, and is authorized the same way as the first.
      */
-    handle(command: SimCreateStateMachineCommand): SimCreateStateMachineCommandOutput;
+    handle(command: SimCreateStateMachineCommand, options?: SimStepFunctionsRequestOptions): SimCreateStateMachineCommandOutput;
 }
 export {};

package/dist/service/stepfunctions/command/machine/sim-state-machine-create.js

@@ -7,10 +7,12 @@ import { readSimStateMachineCreateInput, } from "./sim-state-machine-input.js";
  */
 export class SimStateMachineCreate {
     #stateMachines;
+    #authorizer;
     #accountRegionScope;
     #background;
     constructor(properties) {
         this.#stateMachines = properties.stateMachines;
+        this.#authorizer = properties.authorizer;
         this.#accountRegionScope = properties.accountRegionScope;
         this.#background = properties.background;
     }
@@ -23,10 +25,12 @@ export class SimStateMachineCreate {
      *
      * `CreateStateMachine` is idempotent. A second request carrying the same
      * name, definition and type answers with the state machine that is already
-     * there.
+     * there, and is authorized the same way as the first.
      */
-    handle(command) {
+    handle(command, options) {
         const read = readSimStateMachineCreateInput(command.input);
+        this.#authorizer.authorizeStateMachineName("states:CreateStateMachine", read.name, options?.caller);
+        this.#authorizer.authorizePassRole(read.roleArn, options?.caller);
         const existing = this.#stateMachines.findByName(read.name);
         if (existing !== undefined) {
             return answerForExisting(existing, read);

package/dist/service/stepfunctions/command/machine/sim-state-machine-delete.d.ts

@@ -0,0 +1,26 @@
+import type { SimStatesExecutionStore } from "../../execution/sim-states-execution-store.js";
+import type { SimStateMachineStore } from "../../machine/sim-state-machine-store.js";
+import type { SimStepFunctionsAuthorizer } from "../authorize/sim-step-functions-authorizer.js";
+import type { SimStepFunctionsRequestOptions } from "../sim-step-functions-request-options.js";
+import type { SimDeleteStateMachineCommand, SimDeleteStateMachineCommandOutput } from "./machine.command.js";
+interface SimStateMachineDeleteProperties {
+    readonly stateMachines: SimStateMachineStore;
+    readonly authorizer: SimStepFunctionsAuthorizer;
+    readonly executions: SimStatesExecutionStore;
+}
+/**
+ * The command that deletes a state machine.
+ */
+export declare class SimStateMachineDelete {
+    #private;
+    constructor(properties: SimStateMachineDeleteProperties);
+    /**
+     * Delete a state machine and forget its executions.
+     *
+     * The caller is authorized against the ARN the request carries, before
+     * anything is looked up. A caller with no permission is refused whether or
+     * not the ARN names a state machine.
+     */
+    handle(command: SimDeleteStateMachineCommand, options?: SimStepFunctionsRequestOptions): SimDeleteStateMachineCommandOutput;
+}
+export {};

package/dist/service/stepfunctions/command/machine/sim-state-machine-delete.js

@@ -0,0 +1,29 @@
+import { requireSimStateMachine, requiredSimStateMachineArn, } from "./sim-state-machine-lookup.js";
+/**
+ * The command that deletes a state machine.
+ */
+export class SimStateMachineDelete {
+    #stateMachines;
+    #authorizer;
+    #executions;
+    constructor(properties) {
+        this.#stateMachines = properties.stateMachines;
+        this.#authorizer = properties.authorizer;
+        this.#executions = properties.executions;
+    }
+    /**
+     * Delete a state machine and forget its executions.
+     *
+     * The caller is authorized against the ARN the request carries, before
+     * anything is looked up. A caller with no permission is refused whether or
+     * not the ARN names a state machine.
+     */
+    handle(command, options) {
+        const { stateMachineArn } = command.input;
+        this.#authorizer.authorizeStateMachineArn("states:DeleteStateMachine", requiredSimStateMachineArn(stateMachineArn, "DeleteStateMachine"), options?.caller);
+        const { arn } = requireSimStateMachine(this.#stateMachines, stateMachineArn, "DeleteStateMachine");
+        this.#stateMachines.remove(arn);
+        this.#executions.removeForStateMachine(arn);
+        return {};
+    }
+}

package/dist/service/stepfunctions/command/machine/sim-state-machine-lookup.d.ts

@@ -1,5 +1,12 @@
 import type { SimStateMachine } from "../../machine/sim-state-machine.js";
 import type { SimStateMachineStore } from "../../machine/sim-state-machine-store.js";
+/**
+ * The state machine ARN a request names, or a refusal saying it needs one.
+ *
+ * A command authorizes against this before looking anything up, the way real
+ * IAM decides a request before the service handles it.
+ */
+export declare function requiredSimStateMachineArn(arn: string | undefined, commandName: string): string;
 /**
  * Find the state machine a request's ARN names, or say why it could not be.
  */

package/dist/service/stepfunctions/command/machine/sim-state-machine-lookup.js

@@ -1,12 +1,21 @@
 import { SimStatesInvalidRequest, SimStatesResourceNotFound, } from "../../error/sim-step-functions.error.js";
 /**
- * Find the state machine a request's ARN names, or say why it could not be.
+ * The state machine ARN a request names, or a refusal saying it needs one.
+ *
+ * A command authorizes against this before looking anything up, the way real
+ * IAM decides a request before the service handles it.
  */
-export function requireSimStateMachine(stateMachines, arn, commandName) {
+export function requiredSimStateMachineArn(arn, commandName) {
     if (arn === undefined) {
         throw new SimStatesInvalidRequest(`${commandName} needs a stateMachineArn.`);
     }
-    const stateMachine = stateMachines.find(arn);
+    return arn;
+}
+/**
+ * Find the state machine a request's ARN names, or say why it could not be.
+ */
+export function requireSimStateMachine(stateMachines, arn, commandName) {
+    const stateMachine = stateMachines.find(requiredSimStateMachineArn(arn, commandName));
     if (stateMachine === undefined) {
         throw new SimStatesResourceNotFound(`${arn} is not a simulated state machine in this Account and Region.`);
     }

package/dist/service/stepfunctions/command/machine/sim-state-machine-update.d.ts

@@ -0,0 +1,19 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimStateMachineStore } from "../../machine/sim-state-machine-store.js";
+import type { SimUpdateStateMachineCommand, SimUpdateStateMachineCommandOutput } from "./machine.command.js";
+interface SimStateMachineUpdateProperties {
+    readonly stateMachines: SimStateMachineStore;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * The command that changes a state machine's definition or role.
+ */
+export declare class SimStateMachineUpdate {
+    #private;
+    constructor(properties: SimStateMachineUpdateProperties);
+    /**
+     * Change a state machine's definition or role.
+     */
+    handle(command: SimUpdateStateMachineCommand): SimUpdateStateMachineCommandOutput;
+}
+export {};

package/dist/service/stepfunctions/command/machine/{sim-state-machine-writes.js → sim-state-machine-update.js}

@@ -2,21 +2,19 @@ import { parseSimStatesDefinition } from "../../definition/sim-states-definition
 import { SimStatesInvalidRequest } from "../../error/sim-step-functions.error.js";
 import { requireSimStateMachine } from "./sim-state-machine-lookup.js";
 /**
- * The commands that change and delete state machines.
+ * The command that changes a state machine's definition or role.
  */
-export class SimStateMachineWrites {
+export class SimStateMachineUpdate {
     #stateMachines;
-    #executions;
     #background;
     constructor(properties) {
         this.#stateMachines = properties.stateMachines;
-        this.#executions = properties.executions;
         this.#background = properties.background;
     }
     /**
      * Change a state machine's definition or role.
      */
-    update(command) {
+    handle(command) {
         const { stateMachineArn, definition, roleArn } = command.input;
         if (definition === undefined && roleArn === undefined) {
             throw new SimStatesInvalidRequest("UpdateStateMachine needs a definition or a roleArn to change.");
@@ -31,13 +29,4 @@ export class SimStateMachineWrites {
         });
         return { updateDate: this.#background.now() };
     }
-    /**
-     * Delete a state machine and forget its executions.
-     */
-    delete(command) {
-        const found = requireSimStateMachine(this.#stateMachines, command.input.stateMachineArn, "DeleteStateMachine");
-        this.#stateMachines.remove(found.arn);
-        this.#executions.removeForStateMachine(found.arn);
-        return {};
-    }
 }

package/dist/service/stepfunctions/sim-step-functions.d.ts

@@ -1,6 +1,7 @@
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simStatesCommands from "./command/sim-step-functions-command.types.js";
 import type { SimStepFunctionsRequestOptions } from "./command/sim-step-functions-request-options.js";
 import { type SimStatesDefinitionStore } from "./definition/store/sim-states-definition-store.js";
@@ -10,6 +11,7 @@ import type { SimStatesTaskTargets } from "./task/sim-states-task-invocation.js"
 import { SimStepFunctionsInspection } from "./sim-step-functions-inspection.js";
 interface SimStepFunctionsProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
     /**
      * Where a `Task` state does its work. A simulated Step Functions built on
@@ -31,6 +33,10 @@ interface SimStepFunctionsProperties {
  * `Task`, `Choice`, `Wait`, `Succeed` and `Fail`, and a definition using any
  * other is refused by name.
  *
+ * Creating and deleting a state machine are decided by simulated IAM. The
+ * other operations here are not. A caller an account would refuse still
+ * reaches those.
+ *
  * An execution runs on the simulation's background scheduler rather than in
  * the `StartExecution` call. An execution with nothing to wait for settles
  * before the caller sees it. A failing execution records the failure and never
@@ -52,13 +58,13 @@ export declare class SimStepFunctions {
      */
     inspection(): SimStepFunctionsInspection;
     /** Handle a CreateStateMachine Command from the SDK. */
-    createStateMachine(command: simStatesCommands.SimCreateStateMachineCommand, _options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimCreateStateMachineCommandOutput>;
+    createStateMachine(command: simStatesCommands.SimCreateStateMachineCommand, options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimCreateStateMachineCommandOutput>;
     /** Handle a DescribeStateMachine Command from the SDK. */
     describeStateMachine(command: simStatesCommands.SimDescribeStateMachineCommand, _options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimDescribeStateMachineCommandOutput>;
     /** Handle an UpdateStateMachine Command from the SDK. */
     updateStateMachine(command: simStatesCommands.SimUpdateStateMachineCommand, _options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimUpdateStateMachineCommandOutput>;
     /** Handle a DeleteStateMachine Command from the SDK. */
-    deleteStateMachine(command: simStatesCommands.SimDeleteStateMachineCommand, _options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimDeleteStateMachineCommandOutput>;
+    deleteStateMachine(command: simStatesCommands.SimDeleteStateMachineCommand, options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimDeleteStateMachineCommandOutput>;
     /** Handle a ListStateMachines Command from the SDK. */
     listStateMachines(command: simStatesCommands.SimListStateMachinesCommand, _options?: SimStepFunctionsRequestOptions): Promise<simStatesCommands.SimListStateMachinesCommandOutput>;
     /** Handle a TagResource Command from the SDK. */

package/dist/service/stepfunctions/sim-step-functions.js

@@ -1,10 +1,13 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
+import { SimStepFunctionsAuthorizer } from "./command/authorize/sim-step-functions-authorizer.js";
 import { SimStatesExecutionDescribe } from "./command/execution/sim-states-execution-describe.js";
 import { SimStatesExecutionStart } from "./command/execution/sim-states-execution-start.js";
 import { SimStateMachineCreate } from "./command/machine/sim-state-machine-create.js";
 import { SimStateMachineReads } from "./command/machine/sim-state-machine-reads.js";
-import { SimStateMachineWrites } from "./command/machine/sim-state-machine-writes.js";
+import { SimStateMachineDelete } from "./command/machine/sim-state-machine-delete.js";
+import { SimStateMachineUpdate } from "./command/machine/sim-state-machine-update.js";
 import { SimStateMachineTagCommands } from "./command/tag/sim-state-machine-tag-commands.js";
 import { SimStatesNoDefinitionStore, } from "./definition/store/sim-states-definition-store.js";
 import { SimStatesExecutionStore } from "./execution/sim-states-execution-store.js";
@@ -22,6 +25,10 @@ import { SimStepFunctionsInspection } from "./sim-step-functions-inspection.js";
  * `Task`, `Choice`, `Wait`, `Succeed` and `Fail`, and a definition using any
  * other is refused by name.
  *
+ * Creating and deleting a state machine are decided by simulated IAM. The
+ * other operations here are not. A caller an account would refuse still
+ * reaches those.
+ *
  * An execution runs on the simulation's background scheduler rather than in
  * the `StartExecution` call. An execution with nothing to wait for settles
  * before the caller sees it. A failing execution records the failure and never
@@ -32,7 +39,8 @@ export class SimStepFunctions {
     #stateMachines = new SimStateMachineStore();
     #executions = new SimStatesExecutionStore();
     #machineReads;
-    #machineWrites;
+    #machineUpdate;
+    #machineDelete;
     #machineCreate;
     #executionStart;
     #executionDescribe;
@@ -43,19 +51,28 @@ export class SimStepFunctions {
     #inspection = new SimStepFunctionsInspection(this.#executions);
     constructor(properties = {}) {
         const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), taskTargets = new SimStatesNoTaskTargets(), definitions = new SimStatesNoDefinitionStore(), } = properties;
+        const authorizer = new SimStepFunctionsAuthorizer({
+            iam: simIamInRegion(properties.iam, accountRegionScope.regionName),
+            accountRegionScope,
+        });
         this.#background = background;
         this.#cfnFactory = new SimStepFunctionsCfnResourceFactory({
             stepFunctions: this,
             definitions,
         });
         this.#machineReads = new SimStateMachineReads(this.#stateMachines);
-        this.#machineWrites = new SimStateMachineWrites({
+        this.#machineUpdate = new SimStateMachineUpdate({
             stateMachines: this.#stateMachines,
-            executions: this.#executions,
             background,
         });
+        this.#machineDelete = new SimStateMachineDelete({
+            stateMachines: this.#stateMachines,
+            authorizer,
+            executions: this.#executions,
+        });
         this.#machineCreate = new SimStateMachineCreate({
             stateMachines: this.#stateMachines,
+            authorizer,
             accountRegionScope,
             background,
         });
@@ -84,9 +101,9 @@ export class SimStepFunctions {
         return this.#inspection;
     }
     /** Handle a CreateStateMachine Command from the SDK. */
-    async createStateMachine(command, _options) {
+    async createStateMachine(command, options) {
         await this.#background.sequence();
-        return this.#machineCreate.handle(command);
+        return this.#machineCreate.handle(command, options);
     }
     /** Handle a DescribeStateMachine Command from the SDK. */
     async describeStateMachine(command, _options) {
@@ -96,12 +113,12 @@ export class SimStepFunctions {
     /** Handle an UpdateStateMachine Command from the SDK. */
     async updateStateMachine(command, _options) {
         await this.#background.sequence();
-        return this.#machineWrites.update(command);
+        return this.#machineUpdate.handle(command);
     }
     /** Handle a DeleteStateMachine Command from the SDK. */
-    async deleteStateMachine(command, _options) {
+    async deleteStateMachine(command, options) {
         await this.#background.sequence();
-        return this.#machineWrites.delete(command);
+        return this.#machineDelete.handle(command, options);
     }
     /** Handle a ListStateMachines Command from the SDK. */
     async listStateMachines(command, _options) {

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -5,6 +5,7 @@ import { type BackgroundScheduler } from "../../../../util/background/background
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
 import type { SimAwsCaller, SimAwsDefaultCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../../../aws/caller/sim-aws-ambient-caller.js";
 interface AssumeRoleCommandHandlerProperties {
     readonly sourceAccountId: SimAwsAccountId;
     /**
@@ -17,6 +18,10 @@ interface AssumeRoleCommandHandlerProperties {
      * The caller this simulation attributes a request naming none to.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * STS AssumeRoleCommand handler.

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -27,6 +27,7 @@ export class AssumeRoleCommandHandler {
         this.background = background;
         this.callerResolver = new SimAwsCallerResolver({
             defaultCaller: properties.defaultCaller,
+            ambientCaller: properties.ambientCaller,
         });
         this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
             sourceAccountId,