@kensio/yulin 1.20.16 → 1.21.0

package/docs/services/cloudwatch/README.md

@@ -285,10 +285,12 @@ deploy the stack, publish a breaching datapoint, advance the clock and read the
 whatever is subscribed. Deleting the stack deletes the alarm and takes its scheduled evaluation back
 off the clock with it.
 
-`AlarmName` may be left out, and the alarm is then named after the stack and the logical ID. A test
-still has a name to pass to `DescribeAlarms`. Real CloudFormation generates a physical ID of the
-same shape with a random tail on the end. The tail is left off here, so the name is one a test can
-predict.
+`AlarmName` may be left out, and the alarm is then named after the stack, the logical ID and a tail
+derived from both. Real CloudFormation ends a physical ID of the same shape in twelve random
+characters, and the tail here comes from the name it follows, giving one alarm the same name at
+every deployment. `simAws.cloudWatch().allAlarms()` hands a test the name to pass to
+`DescribeAlarms`, and [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover how a long name is trimmed.
 
 These are the properties acted on: `AlarmName`, `AlarmDescription`, `ActionsEnabled`,
 `AlarmActions`, `OKActions`, `InsufficientDataActions`, `Namespace`, `MetricName`, `Dimensions`,

package/docs/services/cognito/README.md

@@ -3314,10 +3314,11 @@ same thing about the property and differ in what they do about it. A direct API
 request to fail, and a template has every other resource in it to think about.
 
 `UserPoolName` and `ClientName` are optional. A template that sets neither gets
-`<stack name>-<logical id>`, as real CloudFormation generates a name, trimmed to the 128 characters
-Cognito allows if the two are longer than that together. Real CloudFormation adds random characters
-on the end and this adds none. The name is the same on every deployment of the same template, and a
-test can assert it.
+`<stack name>-<logical id>-<tail>`, as real CloudFormation generates a name, trimmed to the 128
+characters Cognito allows if the parts are longer than that together. The tail is twelve characters
+derived from the other two, where real CloudFormation ends the name in twelve random ones. The name
+is the same on every deployment of the same template, and [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover how a long name is trimmed.
 
 ## Registering a pool with a chosen pool id
 
@@ -3461,13 +3462,13 @@ await stack.waitForDeployComplete();
 
 const userPoolId = stack.output("PoolId");
 
-// The pool is named after the stack and the logical id, as the template named
-// neither it nor the client.
+// The pool is named after the stack, the logical id and a tail derived from
+// both, as the template named neither it nor the client.
 const described = await simAws
   .cognitoIdentityProvider()
   .describeUserPool(new DescribeUserPoolCommand({ UserPoolId: userPoolId }));
 
-console.log(described.UserPool?.Name); // "app-stack-Pool"
+console.log(described.UserPool?.Name); // "app-stack-Pool-2c3041dc539d"
 
 // What the template declared is reported back. This one is acted on: it is
 // what says only an admin creates users in this pool.

package/docs/services/dynamodb/README.md

@@ -3107,11 +3107,12 @@ the template gets wrong fails the same way it would for an SDK caller.
 updates it. A specification the template got wrong is refused in the words `UpdateTimeToLive`
 refuses it in.
 
-A table with no `TableName` is named after the stack and its logical ID. The table above with its
-name left out would be `orders-stack-OrdersTable`. Real CloudFormation adds random characters to
-that, which a template cannot predict either way. Two stacks deploying the same template get two
-differently named tables. The generated name is trimmed to the 255 characters a table name allows,
-ending in a hash of the untrimmed name so two long names that start the same stay apart.
+A table with no `TableName` is named after the stack, its logical ID and a tail derived from both.
+The table above with its name left out would be `orders-stack-OrdersTable-` and twelve more
+characters, where real CloudFormation ends the name in twelve random ones. Two stacks deploying the
+same template get two differently named tables. The name is trimmed to the 255 characters a table
+name allows, and [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover how the stack name and the logical ID share what is left.
 
 `Fn::GetAtt … StreamArn` gives the ARN of the stream the table's `StreamSpecification` gave it. On a
 table with no `StreamSpecification` it is refused by name, naming the table, since an invented

package/docs/services/ecs/README.md

@@ -706,7 +706,11 @@ real ECS accepts for a parameter in the task's own region. A Secrets Manager ARN
 key, a version stage and a version id after the secret id, in the form
 `...:secret:orders/db-AbCdEf:password::` that a CDK construct given a field writes. The key selects
 one field of a secret holding a JSON object. A `SecureString` parameter is decrypted, as it is for a
-real task.
+real task. The decryption is made with the execution role's own permissions. Under the `aws/ssm`
+managed key that role needs `ssm:GetParameter` and nothing on KMS, since the key's policy allows the
+decryption itself (see
+[Sim SSM](../ssm/README.md#the-awsssm-managed-key-allows-the-read-itself)). Under a customer managed
+key it needs `kms:Decrypt` as well.
 
 A secret that cannot be resolved stops the task before any container runs, with a
 `ResourceInitializationError` reason naming the variable:
@@ -1431,7 +1435,9 @@ console.log(processedOrders); // ["outstanding orders"]
 
 A binding can name the task definition Resource instead, which is what a CDK stack gives a test to
 name. The construct ID is accepted as well as the synthesized logical ID, and the container name can
-be left out where the task definition declares one container. A binding naming an image repository
+be left out where the task definition declares one container. This is the form to use for a task
+definition the template declares no `Family` for, since the family CloudFormation generates for it
+ends in a tail a test would have to deploy the stack to learn. A binding naming an image repository
 matches any container running an image from it, whichever family declares it, which covers a tag
 that changes with every build.
 
@@ -1604,9 +1610,9 @@ const listed = await simAws
 console.log(listed.taskArns?.length); // 2
 ```
 
-An unnamed service is named after the stack and the logical ID, as a cluster and a family are. A
-service declaring no `DesiredCount` keeps one task running, which is what real CloudFormation gives
-a new service.
+An unnamed service is named after the stack, the logical ID and a tail derived from both, as a
+cluster and a family are. `Fn::GetAtt ... Name` answers with the generated name. A service declaring
+no `DesiredCount` keeps one task running, which is what real CloudFormation gives a new service.
 
 Updating the stack moves the service. A changed `DesiredCount` scales it, and a changed task
 definition moves it onto the revision the update registered, replacing the tasks it was keeping.
@@ -1645,6 +1651,10 @@ task definition revision it would run, `DescribeTasks` and `StopTask`, which tak
 and the service operations, which take the service's ARN. `CreateService` authorizes against the ARN
 the service is about to have, and a policy can therefore name one service by name before it exists.
 
+A registration carrying a `taskRoleArn` or an `executionRoleArn` hands ECS a Role it runs the task
+as, and `RegisterTaskDefinition` authorizes `iam:PassRole` against each of them. Either Role left out
+passes nothing. See [passing a Role to a service](https://yulinsim.dev/services/iam/#passing-a-role-to-a-service) in the IAM docs.
+
 ```typescript sim-ecs-iam-policy
 /**
  * A simulated IAM policy allowing a Role to register task definitions.
@@ -1782,7 +1792,8 @@ console.log(described.taskDefinition?.revision); // 1
 
 ## Available functionality
 
-- `RegisterTaskDefinitionCommand`, with revisions numbered per family from one
+- `RegisterTaskDefinitionCommand`, with revisions numbered per family from one, authorizing
+  `iam:PassRole` on the `taskRoleArn` and the `executionRoleArn` it names
 - `DeregisterTaskDefinitionCommand`, marking one revision `INACTIVE`
 - `DescribeTaskDefinitionCommand`, taking a family, a `family:revision` or a full ARN
 - `ListTaskDefinitionsCommand` and `ListTaskDefinitionFamiliesCommand`, with prefix, status and
@@ -1967,9 +1978,12 @@ Current documented limitations:
   `DescribeServices` and `ListTasks` are what report those.
 - Task definition and cluster tags are stored and reported, but `TagResource`, `UntagResource` and
   `ListTagsForResource` are absent.
-- An unnamed cluster, task definition or service gets a name composed from the stack name and the
-  logical ID, without the random part real CloudFormation adds, which makes it predictable in a
-  test. A stack deployed twice under different names therefore gets two different families.
+- An unnamed cluster, task definition or service gets a name composed from the stack name, the
+  logical ID and a tail derived from both, in place of the random characters real CloudFormation
+  ends one with. The same stack redeployed gets the same names, and a stack deployed twice under
+  different names gets two different families.
+  [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+  cover the tail and how a long name is trimmed.
 - A service that declares no `DesiredCount` keeps one task running. That is the default real
   CloudFormation documents for a new service. A `DesiredCount` written as the text of a number is
   taken as that number, since a String Parameter resolves to text, and anything else is refused

package/docs/services/elbv2/README.md

@@ -1421,8 +1421,12 @@ fails the deployment.
 - `TargetGroupArn`, `TargetGroupName` and `TargetGroupFullName` on a target group
 - `ListenerArn` on a listener, and `RuleArn` and `IsDefault` on a rule
 
-An unnamed load balancer or target group is named after the stack and the logical ID, trimmed to the
-32 characters ELB allows. A target group declaring `Targets` has them registered as part of creating
+An unnamed load balancer or target group is named after the stack, the logical ID and a tail derived
+from both, trimmed to the 32 characters ELB allows. The tail takes 13 of those. A name that has to
+be trimmed gives the stack name and the logical ID nine characters each, and either takes what the
+other leaves.
+[the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover the rule. A target group declaring `Targets` has them registered as part of creating
 it, and the group routes as soon as the stack has deployed.
 
 ```typescript sim-elbv2-cloudformation

package/docs/services/eventbridge/README.md

@@ -909,7 +909,10 @@ console.log(handled.length); // 1
 `Ref` returns the **name** of a bus or a rule, and never its ARN. That is what AWS returns, and it
 makes a bus `Ref` usable straight away as another resource's `EventBusName`. The ARN comes from
 `Fn::GetAtt ... Arn`, which an `AWS::Lambda::Permission` `SourceArn` needs. An unnamed rule gets a
-name generated from the stack name and the logical ID, as real CloudFormation generates one.
+name generated from the stack name, the logical ID and a tail derived from both, as
+[the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+describe. A rule name caps at 64 characters. A stack name and logical ID longer than that together
+are trimmed to 25 characters each, and either takes what the other leaves.
 
 A target property this simulation leaves out, such as `InputTransformer` or `InputPath`, is refused
 at deploy time naming the property and the Resource. The alternative is a rule that sends the whole
@@ -1005,6 +1008,10 @@ console.log(JSON.stringify(policy).length > 0); // true
 A caller refused by IAM gets `AccessDeniedException`. Permission is checked before the bus is looked
 up, and a caller who may not reach a bus is refused whether or not that bus exists.
 
+An ECS target carries a `RoleArn`, which the rule runs the task as. Adding one hands EventBridge that
+Role, and `PutTargets` authorizes `iam:PassRole` against it. See
+[passing a Role to a service](https://yulinsim.dev/services/iam/#passing-a-role-to-a-service) in the IAM docs.
+
 ## Scoping
 
 Buses belong to one account and region, as they do on real AWS:
@@ -1057,6 +1064,7 @@ no permission for.
   listings.
 - The event envelope EventBridge builds from an entry, reached through `eventsOn(...)`.
 - IAM authorization against the bus ARN.
+- `iam:PassRole` authorization of the `RoleArn` an ECS target carries.
 - SDK interception of `EventBridgeClient`.
 
 ## Limitations

package/docs/services/firehose/README.md

@@ -378,6 +378,10 @@ Deleting the delivery stream stops it reading. Records put afterwards stay on th
 Every Firehose operation authorizes against the `firehose:` action of the same name, on the ARN of
 the delivery stream it names. `ListDeliveryStreams` names none, and authorizes against `*`.
 
+Creating a delivery stream hands Firehose the destination `RoleARN`, and the source `RoleARN` too
+where it reads a Kinesis stream. `CreateDeliveryStream` authorizes `iam:PassRole` against each of
+them. See [passing a Role to a service](https://yulinsim.dev/services/iam/#passing-a-role-to-a-service) in the IAM docs.
+
 The delivery itself is a separate request, made as the delivery stream's `RoleARN`. The caller who
 put the record needs no S3 permission at all, and a Role that cannot write to the Bucket fails the
 delivery. Real
@@ -607,8 +611,10 @@ writes into the Bucket beside it, as the Role beside it, and a Role without `s3:
 delivery the same way one created through `CreateDeliveryStream` does. Deleting the stack deletes the
 delivery stream.
 
-A delivery stream the template does not name is named after the stack and the logical ID, as real
-CloudFormation names one. The name is trimmed to the 64 characters Firehose allows.
+A delivery stream the template does not name is named after the stack, the logical ID and a tail
+derived from both, as real CloudFormation names one. The name is trimmed to the 64 characters
+Firehose allows, and [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover how the two parts share what is left.
 
 `DeliveryStreamEncryptionConfigurationInput` and `DirectPutSourceConfiguration` are recorded against
 the resource as unsimulated, and the delivery stream deploys anyway. The destination properties this
@@ -737,7 +743,7 @@ console.log(Contents?.length);
 
 | Command                  | Notes                                                                                                   |
 | ------------------------ | ------------------------------------------------------------------------------------------------------- |
-| `CreateDeliveryStream`   | A name already in use raises `ResourceInUseException`.                                                  |
+| `CreateDeliveryStream`   | A name already in use raises `ResourceInUseException`. Authorizes `iam:PassRole` on each Role it names. |
 | `DeleteDeliveryStream`   | The name is free again at once. Whatever was buffered goes with it.                                     |
 | `ListDeliveryStreams`    | Sorted by name, paged with `Limit` and `ExclusiveStartDeliveryStreamName`.                              |
 | `DescribeDeliveryStream` | Reports the one destination, and a Kinesis source under `Source`.                                       |

package/docs/services/glue/README.md

@@ -131,6 +131,12 @@ Column names keep the case they were given, including partition keys. Real Glue
 and simulated [Athena](https://yulinsim.dev/services/athena/ "Simulated Athena usage docs") folds a
 column name only when it runs a query.
 
+A database or a table the template leaves unnamed is named from the stack name, the logical ID and a
+tail derived from both, folded the same way. A `LogTable` in `analytics-stack` becomes
+`analytics-stack-logtable-` and twelve more characters, where real CloudFormation ends the name in
+twelve random ones. The name is trimmed to the 255 bytes the catalog allows, and [the CloudFormation docs](https://yulinsim.dev/services/cloudformation/#names-cloudformation-generates "Names CloudFormation generates")
+cover how the stack name and the logical ID share what is left.
+
 ## Reading the catalog back
 
 `GetDatabase`, `GetDatabases`, `GetTable` and `GetTables` answer through the SDK. A `SimGlue` also