@kensio/yulin 1.20.17 → 1.21.0

package/docs/services/ecs/README.md

@@ -706,8 +706,11 @@ real ECS accepts for a parameter in the task's own region. A Secrets Manager ARN
 key, a version stage and a version id after the secret id, in the form
 `...:secret:orders/db-AbCdEf:password::` that a CDK construct given a field writes. The key selects
 one field of a secret holding a JSON object. A `SecureString` parameter is decrypted, as it is for a
-real task. The decryption is made with the execution role's own permissions, and that role needs
-`kms:Decrypt` on top of `ssm:GetParameter`.
+real task. The decryption is made with the execution role's own permissions. Under the `aws/ssm`
+managed key that role needs `ssm:GetParameter` and nothing on KMS, since the key's policy allows the
+decryption itself (see
+[Sim SSM](../ssm/README.md#the-awsssm-managed-key-allows-the-read-itself)). Under a customer managed
+key it needs `kms:Decrypt` as well.
 
 A secret that cannot be resolved stops the task before any container runs, with a
 `ResourceInitializationError` reason naming the variable:

package/docs/services/kms/README.md

@@ -357,11 +357,15 @@ That is why a role holding `kms:Decrypt` on such a key cannot use it by calling
 `SecureString` parameters. Code calling simulated KMS directly sets it with the `viaService` request
 option, naming the service on its own (`ssm`), since the region is the key's.
 
-A service passing on the caller's own KMS permissions sets `withCallerPermissions` alongside it.
-What the policy above admits is the service a request came through. A request carrying this option
-is allowed only where IAM allows the caller the KMS action too, and a key policy naming the caller
-allows it on its own. Sim SSM sets the option when it decrypts a `SecureString`. A role holding
-`ssm:GetParameter` and no `kms:Decrypt` is refused the decrypted value.
+The first statement above allows the request outright, so nothing further is asked of the caller. A
+role holding `ssm:GetParameter` and nothing on KMS reads a decrypted `SecureString` under `aws/ssm`,
+because Parameter Store supplies the `kms:ViaService` value the policy wants (see
+[Sim SSM](../ssm/README.md#the-awsssm-managed-key-allows-the-read-itself)).
+
+A service that passes the caller's own KMS permissions on rather than its own sets
+`withCallerPermissions` alongside `viaService`. A request carrying that option is allowed only where
+IAM allows the caller the KMS action too, and a key policy naming the caller still allows it on its
+own. No simulated service sets it.
 
 ```typescript sim-kms-aws-managed-key
 /**

package/docs/services/logs/README.md

@@ -749,6 +749,12 @@ the three listing operations an SDK caller reaches, and a deployment goes near n
 CloudFormation execution Role therefore carries the same policy here that a real deploy of the
 template needs.
 
+A delivery source over a CloudFront distribution takes one CloudFront permission on top of those.
+CloudWatch Logs checks the caller for `cloudfront:AllowVendedLogDeliveryForResource` against the
+distribution's ARN as the source is put, and a caller holding every `logs:` action and no CloudFront
+permission is refused. A policy naming another distribution is refused the same way. A delivery
+source over a resource of any other service asks for nothing outside `logs:`.
+
 ```typescript sim-logs-permissions
 /**
  * A simulated IAM policy allowing a Role to write one function's logs.

package/docs/services/ssm/README.md

@@ -472,9 +472,10 @@ recorded the same way.
 references use, so a reference can sit inside a longer value and inside `Fn::Sub`.
 
 Decryption goes to simulated KMS under the key the parameter was written with, as the caller
-deploying the stack. A caller lacking `kms:Decrypt` on that key fails the resource with the
-`AccessDenied` a decrypting `GetParameter` raises (see
+deploying the stack. A caller lacking `kms:Decrypt` on a customer managed key fails the resource with
+the `AccessDenied` a decrypting `GetParameter` raises (see
 [A customer managed key needs its own permission](#a-customer-managed-key-needs-its-own-permission)).
+A parameter under the `aws/ssm` managed key needs no KMS permission of the caller.
 
 CDK writes one of these from `SecretValue.ssmSecure`, from
 `ssm.StringParameter.fromSecureStringParameterAttributes` and from the deprecated
@@ -915,24 +916,27 @@ try {
 }
 ```
 
-### The aws/ssm managed key needs kms:Decrypt too
+### The aws/ssm managed key allows the read itself
 
-A parameter naming no key is encrypted under the `aws/ssm` AWS managed key. Parameter Store supplies
-`kms:ViaService`, and that key's policy allows the account's principals to use it through Systems
-Manager. What the policy admits is whoever the request came from. Parameter Store decrypts with the
-caller's own permissions, and a decrypting read needs `kms:Decrypt` on top of `ssm:GetParameter`. A
-role holding the parameter permission alone reads the ciphertext and is refused when it asks for
-decryption, as it is in a real account.
+A parameter naming no key is encrypted under the `aws/ssm` AWS managed key. That key's policy allows
+the cryptographic actions to a wildcard principal under `kms:ViaService` and `kms:CallerAccount`
+conditions, and Parameter Store satisfies both. A grant of that shape delegates nothing to IAM. A
+role holding `ssm:GetParameter` and nothing on KMS reads the decrypted value, as it does in an
+account, and withholding that access takes an explicit `Deny`.
 
-The managed key's id is unknown when a template is synthesized. A policy scopes the grant with a
-`kms:ViaService` condition naming `ssm.<region>.amazonaws.com`, and simulated IAM evaluates that
-condition against the region the parameter belongs to.
+`GetParameters` and `GetParametersByPath` decrypt through the same path and on the same permission.
+A `SecureString` write under the managed key asks for no KMS permission either.
 
-`GetParameters` and `GetParametersByPath` decrypt through the same path, and refuse the same way for
-a caller without the key permission.
+A `kms:Decrypt` grant scoped with a `kms:ViaService` condition (the shape a stack writes when the
+key is chosen after synthesis) still works, and it is what a customer managed key wants.
 
-The same role cannot take the ciphertext to KMS itself, because the managed key's policy applies
-only to a request that reached KMS through Systems Manager.
+The key stays out of reach of anything calling KMS directly. The same role handed the stored
+ciphertext cannot decrypt it through `Decrypt`, because the policy's `kms:ViaService` condition
+matches only a request that arrived through Systems Manager. A caller in another account is refused
+by the `kms:CallerAccount` condition.
+
+An ECS task resolves a `secrets` entry through this path. An execution role holding
+`ssm:GetParameter` alone reads a managed key `SecureString` into a container's environment.
 
 ```typescript sim-ssm-secure-string-managed-key
 /**
@@ -969,26 +973,14 @@ const role = await simAws.iam().createRole(
   }),
 );
 
-// The parameter, and the key through Systems Manager.
+// The parameter, and nothing on KMS.
 await simAws.iam().putRolePolicy(
   new PutRolePolicyCommand({
     RoleName: "ConfigReader",
     PolicyName: "ReadDbPassword",
     PolicyDocument: JSON.stringify({
       Version: "2012-10-17",
-      Statement: [
-        { Effect: "Allow", Action: "ssm:GetParameter", Resource: "*" },
-        {
-          Effect: "Allow",
-          Action: "kms:Decrypt",
-          Resource: "*",
-          Condition: {
-            StringEquals: {
-              "kms:ViaService": `ssm.${simAws.defaultRegionName}.amazonaws.com`,
-            },
-          },
-        },
-      ],
+      Statement: { Effect: "Allow", Action: "ssm:GetParameter", Resource: "*" },
     }),
   }),
 );
@@ -1052,9 +1044,10 @@ Current documented limitations:
   without complaint.
 - `KeyId` on a `String` or `StringList` parameter is refused, since nothing would encrypt a value
   stored in the clear.
-- Writing a `SecureString` under the `aws/ssm` managed key asks the caller for no KMS permission,
-  where AWS documents `kms:Encrypt` for a standard tier write. A write under a customer managed key
-  does need it.
+- Reading and writing a `SecureString` under the `aws/ssm` managed key ask the caller for no KMS
+  permission, which follows that key's policy and the Parameter Store setup page. AWS's SecureString
+  encryption page documents `kms:Encrypt` and `kms:Decrypt` for either kind of key, and the two
+  disagree. A parameter under a customer managed key does need them.
 - `DataType` other than `text` is refused. Real Parameter Store validates an `aws:ec2:image` value
   against EC2, which this simulation cannot do.
 - Filters are refused outright. `GetParametersByPath` refuses `ParameterFilters`, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.20.17",
+  "version": "1.21.0",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",