@kensio/yulin 1.20.17 → 1.21.0

package/dist/service/iam/authorize/context/sim-iam-auth-z-input.d.ts

@@ -78,10 +78,12 @@ export interface SimIamAuthorizationInput {
      * resource policy admitting the caller is enough on its own. A service sets
      * this where it reaches another service as the caller. A resource policy
      * that admits whoever the request came from then grants nothing by itself,
-     * because what it admits is the service. Reading a SecureString needs
-     * kms:Decrypt for that reason, even under the aws/ssm key, whose policy
-     * admits the Account's principals reaching KMS through Parameter Store. A
-     * resource policy naming the caller still allows the request on its own.
+     * because what it admits is the service. A resource policy naming the caller
+     * still allows the request on its own.
+     *
+     * No simulated service sets this. Parameter Store is the case it was written
+     * for, and the aws/ssm key policy grants its cryptographic actions to a
+     * wildcard principal outright.
      */
     readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/kms/command/sim-kms-request-options.d.ts

@@ -24,11 +24,15 @@ export interface SimKmsRequestOptions {
      * Whether the service named by `viaService` is making the request with the
      * caller's own KMS permissions rather than with its own.
      *
-     * Parameter Store decrypts a SecureString this way. A caller holding
-     * ssm:GetParameter and no kms:Decrypt is refused even under the aws/ssm key,
-     * whose policy admits the Account's principals reaching KMS through Systems
-     * Manager. A key policy naming the caller still allows the request on its
-     * own, as it does for any other KMS request.
+     * A key policy admitting whoever the request came from then grants nothing
+     * by itself, because what it admits is the service, and the caller has to
+     * hold the KMS action in an identity policy as well. A key policy naming the
+     * caller still allows the request on its own, as it does for any other KMS
+     * request.
+     *
+     * No simulated service sets this. Parameter Store is the case it was written
+     * for, and the aws/ssm key policy grants its cryptographic actions to a
+     * wildcard principal outright.
      */
     readonly withCallerPermissions?: boolean | undefined;
 }

package/dist/service/logs/command/delivery/sim-logs-delivery-source-commands.d.ts

@@ -22,10 +22,12 @@ export declare class SimLogsDeliverySourceCommands {
      * Put a delivery source over a resource whose logs are to be delivered.
      *
      * The service is read from the resource ARN, as real CloudWatch Logs reads
-     * it, and the region the request was made in has to be one that service's
-     * delivery can be set up from. The ARN is then resolved to a resource the
-     * account holds. A source over a distribution the account never created
-     * fails here, ahead of the delivery that would have carried nothing.
+     * it. The caller is then checked against that service as well, because
+     * delivering a resource's logs is a permission the service owning it holds.
+     * The region the request was made in has to be one that service's delivery
+     * can be set up from, and the ARN is then resolved to a resource the account
+     * holds. A source over a distribution the account never created fails here,
+     * ahead of the delivery that would have carried nothing.
      */
     putDeliverySource(command: SimPutDeliverySourceCommand, options?: SimLogsRequestOptions): SimPutDeliverySourceCommandOutput;
     /**

package/dist/service/logs/command/delivery/sim-logs-delivery-source-commands.js

@@ -1,3 +1,4 @@
+import { authorizeSimLogsVendedLogDelivery } from "../../delivery/cloudfront/sim-logs-vended-log-delivery.js";
 import { simLogsAnyDeliverySourceArn, simLogsDeliverySourceArn, } from "../../delivery/sim-logs-delivery-arn.js";
 import { requireSimLogsDeliverySource, requiredSimLogsDeliveredService, } from "../../delivery/sim-logs-delivery-source-service.js";
 import { SimLogsDeliverySource } from "../../delivery/sim-logs-delivery-source.js";
@@ -28,10 +29,12 @@ export class SimLogsDeliverySourceCommands {
      * Put a delivery source over a resource whose logs are to be delivered.
      *
      * The service is read from the resource ARN, as real CloudWatch Logs reads
-     * it, and the region the request was made in has to be one that service's
-     * delivery can be set up from. The ARN is then resolved to a resource the
-     * account holds. A source over a distribution the account never created
-     * fails here, ahead of the delivery that would have carried nothing.
+     * it. The caller is then checked against that service as well, because
+     * delivering a resource's logs is a permission the service owning it holds.
+     * The region the request was made in has to be one that service's delivery
+     * can be set up from, and the ARN is then resolved to a resource the account
+     * holds. A source over a distribution the account never created fails here,
+     * ahead of the delivery that would have carried nothing.
      */
     putDeliverySource(command, options) {
         const input = command.input;
@@ -41,6 +44,12 @@ export class SimLogsDeliverySourceCommands {
         refuseUnsimulatedDeliveryTags(input.tags, "PutDeliverySource");
         this.#authorizer.authorizeResource("logs:PutDeliverySource", simLogsDeliverySourceArn(this.#scope, name), options?.caller);
         const service = requiredSimLogsDeliveredService(resourceArn);
+        authorizeSimLogsVendedLogDelivery({
+            authorizer: this.#authorizer,
+            service,
+            resourceArn,
+            caller: options?.caller,
+        });
         requireSimLogsDeliverySource({
             service,
             regionName: this.#scope.regionName,

package/dist/service/logs/delivery/cloudfront/sim-logs-vended-log-delivery.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimLogsAuthorizer } from "../../command/authorize/sim-logs-authorizer.js";
+interface SimLogsVendedLogDeliveryAuthorization {
+    readonly authorizer: SimLogsAuthorizer;
+    readonly service: string;
+    readonly resourceArn: string;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Authorize delivering the logs of the resource a delivery source names.
+ *
+ * Creating a delivery source calls CloudWatch Logs, and CloudWatch Logs then
+ * checks the caller against the service that owns the resource being logged.
+ * A policy is usually written by asking which service owns the resource type,
+ * and that question gives the wrong answer here. A caller allowed every
+ * `logs:` action and denied CloudFront outright is refused.
+ *
+ * CloudFront is the one delivered service checked, because it is the one the
+ * simulation can name a resource of. A source over an ARN of any other service
+ * carries on as it always did.
+ */
+export declare function authorizeSimLogsVendedLogDelivery(properties: SimLogsVendedLogDeliveryAuthorization): void;
+export {};

package/dist/service/logs/delivery/cloudfront/sim-logs-vended-log-delivery.js

@@ -0,0 +1,28 @@
+import { simLogsCloudFrontDeliveryService } from "../sim-logs-delivery-source-service.js";
+/**
+ * The CloudFront action a delivery source over a distribution is checked for.
+ *
+ * CloudFront names it and nobody calls it. It exists so that setting up
+ * delivery from a distribution is a permission of its own, held apart from
+ * everything else a caller may do to that distribution.
+ */
+const simLogsVendedLogDeliveryAction = "cloudfront:AllowVendedLogDeliveryForResource";
+/**
+ * Authorize delivering the logs of the resource a delivery source names.
+ *
+ * Creating a delivery source calls CloudWatch Logs, and CloudWatch Logs then
+ * checks the caller against the service that owns the resource being logged.
+ * A policy is usually written by asking which service owns the resource type,
+ * and that question gives the wrong answer here. A caller allowed every
+ * `logs:` action and denied CloudFront outright is refused.
+ *
+ * CloudFront is the one delivered service checked, because it is the one the
+ * simulation can name a resource of. A source over an ARN of any other service
+ * carries on as it always did.
+ */
+export function authorizeSimLogsVendedLogDelivery(properties) {
+    if (properties.service !== simLogsCloudFrontDeliveryService) {
+        return;
+    }
+    properties.authorizer.authorizeResource(simLogsVendedLogDeliveryAction, properties.resourceArn, properties.caller);
+}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -18,6 +18,10 @@ export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
  * caller.
  */
 export declare const ssmKmsViaService = "ssm";
+interface SimSsmKmsOptions {
+    readonly caller?: SimAwsCaller | undefined;
+    readonly viaService?: string | undefined;
+}
 /**
  * The narrow slice of simulated KMS that SecureString parameters need.
  *
@@ -32,11 +36,7 @@ export interface SimSsmKmsCrypto {
             Plaintext?: Uint8Array | undefined;
             EncryptionContext?: Readonly<Record<string, string>> | undefined;
         };
-    }, options?: {
-        caller?: SimAwsCaller | undefined;
-        viaService?: string | undefined;
-        withCallerPermissions?: boolean | undefined;
-    }): Promise<{
+    }, options?: SimSsmKmsOptions): Promise<{
         CiphertextBlob?: Uint8Array | undefined;
         KeyId?: string | undefined;
     }>;
@@ -45,12 +45,9 @@ export interface SimSsmKmsCrypto {
             CiphertextBlob?: Uint8Array | undefined;
             EncryptionContext?: Readonly<Record<string, string>> | undefined;
         };
-    }, options?: {
-        caller?: SimAwsCaller | undefined;
-        viaService?: string | undefined;
-        withCallerPermissions?: boolean | undefined;
-    }): Promise<{
+    }, options?: SimSsmKmsOptions): Promise<{
         Plaintext?: Uint8Array | undefined;
         KeyId?: string | undefined;
     }>;
 }
+export {};

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -18,15 +18,15 @@ interface SimSsmParameterKmsProperties {
  * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
  * for the parameter itself.
  *
- * They are also made through the service, which is what reaches the `aws/ssm`
- * managed key at all. That key's policy admits the Account's principals when
- * `kms:ViaService` names Systems Manager, and Parameter Store is what supplies
- * it. Reaching the key is not the same as being allowed to use it, and a
- * decrypting read says so with `withCallerPermissions`, because that policy
- * admits whoever the request came from rather than the caller behind it. A
- * Role holding `ssm:GetParameter` and no `kms:Decrypt` reads the ciphertext
- * and not the value. A write under that key asks the caller for no KMS
- * permission here, where AWS documents `kms:Encrypt` for one.
+ * They are also made through the service, and passing through it is what
+ * reaches the `aws/ssm` managed key at all. That key's policy allows the
+ * cryptographic actions to a wildcard principal under `kms:ViaService` and
+ * `kms:CallerAccount` conditions, and Parameter Store supplies the first of
+ * them. A grant of that shape delegates nothing to IAM, and it admits the
+ * request by itself. A Role holding `ssm:GetParameter` and nothing on KMS
+ * reads the decrypted value, as it does in an account. A caller in another
+ * Account fails the `kms:CallerAccount` condition, and a caller reaching KMS
+ * directly carries no `kms:ViaService` for the policy to match.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.
@@ -39,8 +39,7 @@ export declare class SimSsmParameterKms {
      */
     encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
     /**
-     * Decrypt a parameter value, which needs the same binding it was made with,
-     * and the caller's own permission to use the key.
+     * Decrypt a parameter value, which needs the same binding it was made with.
      */
     decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
     private contextFor;

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js

@@ -18,15 +18,15 @@ const parameterArnContextKey = "PARAMETER_ARN";
  * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
  * for the parameter itself.
  *
- * They are also made through the service, which is what reaches the `aws/ssm`
- * managed key at all. That key's policy admits the Account's principals when
- * `kms:ViaService` names Systems Manager, and Parameter Store is what supplies
- * it. Reaching the key is not the same as being allowed to use it, and a
- * decrypting read says so with `withCallerPermissions`, because that policy
- * admits whoever the request came from rather than the caller behind it. A
- * Role holding `ssm:GetParameter` and no `kms:Decrypt` reads the ciphertext
- * and not the value. A write under that key asks the caller for no KMS
- * permission here, where AWS documents `kms:Encrypt` for one.
+ * They are also made through the service, and passing through it is what
+ * reaches the `aws/ssm` managed key at all. That key's policy allows the
+ * cryptographic actions to a wildcard principal under `kms:ViaService` and
+ * `kms:CallerAccount` conditions, and Parameter Store supplies the first of
+ * them. A grant of that shape delegates nothing to IAM, and it admits the
+ * request by itself. A Role holding `ssm:GetParameter` and nothing on KMS
+ * reads the decrypted value, as it does in an account. A caller in another
+ * Account fails the `kms:CallerAccount` condition, and a caller reaching KMS
+ * directly carries no `kms:ViaService` for the policy to match.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.
@@ -54,8 +54,7 @@ export class SimSsmParameterKms {
         };
     }
     /**
-     * Decrypt a parameter value, which needs the same binding it was made with,
-     * and the caller's own permission to use the key.
+     * Decrypt a parameter value, which needs the same binding it was made with.
      */
     async decrypt(parameterArn, ciphertext, caller) {
         const decrypted = await reportingKeyProblems(async () => await this.kms.decrypt({
@@ -63,11 +62,7 @@ export class SimSsmParameterKms {
                 CiphertextBlob: Buffer.from(ciphertext, "base64"),
                 EncryptionContext: this.contextFor(parameterArn),
             },
-        }, {
-            caller,
-            viaService: ssmKmsViaService,
-            withCallerPermissions: true,
-        }));
+        }, { caller, viaService: ssmKmsViaService }));
         assertDefined(decrypted.Plaintext, `Simulated KMS decrypted ${parameterArn} to nothing`);
         return Buffer.from(decrypted.Plaintext).toString("utf8");
     }

package/docs/services/athena/README.md

@@ -383,10 +383,15 @@ its declared result.
 | Binary        | `md5`, `sha1`, `sha256`, `sha512`, `xxhash64`, `murmur3`, `crc32`, `to_hex`, `from_hex`, `to_base64`, `from_base64`, `to_utf8`, `from_utf8`                                                           |
 | URL           | `url_extract_host`, `url_extract_path`, `url_extract_protocol`, `url_extract_port`, `url_extract_query`, `url_extract_fragment`, `url_extract_parameter`, `url_decode`, `url_encode`                  |
 | Approximate   | `approx_distinct`, `approx_percentile`                                                                                                                                                                |
+| Comparison    | `least`, `greatest`                                                                                                                                                                                   |
 
 `substr` and `format` are SQLite's own. Both count from one and take the same `%s` and `%d` a
 statement writes, so shadowing either would replace something that works.
 
+`least` and `greatest` take two arguments or more. Numbers order numerically and text orders by its
+code units, matching SQLite's own `min` and `max` in their wider forms. Trino refuses a call mixing
+the two types and this answers one, ordering everything as text. A `varbinary` argument raises.
+
 The hashing functions answer with bytes and `to_hex` writes those bytes in the upper case Trino
 writes them in. Node carries every digest here apart from xxHash64 and MurmurHash3, and both of
 those are written out by hand against their published vectors. Trino refuses text where a
@@ -404,7 +409,8 @@ instant the query started, which is what the execution records.
 
 A function that cannot answer faithfully raises rather than guessing, and the query falls back.
 `date_add` with a unit Trino does not name, `slice` starting at zero, `array_join` over an array of
-objects, and `regexp_extract` naming a capture group the pattern has not got all land there. A null
+objects, `least` over a `varbinary`, and `regexp_extract` naming a capture group the pattern has not
+got all land there. A null
 answer would be a wrong answer wearing the shape of a right one.
 
 A function answers null where any argument is null, the way Trino's do. An argument left out takes

package/docs/services/cloudformation/README.md

@@ -3518,7 +3518,8 @@ The resource types it creates are:
 - `AWS::CertificateManager::Certificate`
 - `AWS::CloudFormation::WaitConditionHandle`
 - `AWS::CloudFront::Distribution`, `AWS::CloudFront::Function`,
-  `AWS::CloudFront::ResponseHeadersPolicy` and `AWS::CloudFront::CachePolicy`
+  `AWS::CloudFront::ResponseHeadersPolicy`, `AWS::CloudFront::CachePolicy` and
+  `AWS::CloudFront::OriginRequestPolicy`
 - `AWS::CloudWatch::Alarm`
 - `AWS::Cognito::UserPool`, `AWS::Cognito::UserPoolClient` and
   `AWS::Cognito::UserPoolGroup`