@kensio/yulin 1.20.17 → 1.21.1

package/docs/services/sqs/README.md

@@ -1049,8 +1049,39 @@ console.log(stack.output("OrdersQueueArn"));
 ```
 
 The properties applied to the queue are `VisibilityTimeout`, `DelaySeconds`,
-`MessageRetentionPeriod`, `MaximumMessageSize` and `ReceiveMessageWaitTimeSeconds`. Each is passed to
-`CreateQueue`, and a value outside the range real SQS accepts fails the resource.
+`MessageRetentionPeriod`, `MaximumMessageSize`, `ReceiveMessageWaitTimeSeconds` and
+`RedrivePolicy`. Each is passed to `CreateQueue`, and a value outside the range real SQS accepts
+fails the resource.
+
+`RedrivePolicy` is the same attribute [dead-letter queues](#dead-letter-queues) covers, and a
+template goes through the validation an SDK caller goes through. CloudFormation carries the policy
+as an object where SQS carries it as a JSON string, and both spellings arrive at `CreateQueue` the
+same way. The `deadLetterTargetArn` has to name a queue that already exists. Naming the dead-letter
+queue with `Fn::GetAtt` also puts the two queues in the order they have to be created in.
+
+```typescript
+{
+  OrdersDlq: {
+    Type: "AWS::SQS::Queue",
+    Properties: { QueueName: "orders-dlq" },
+  },
+  OrdersQueue: {
+    Type: "AWS::SQS::Queue",
+    Properties: {
+      QueueName: "orders",
+      RedrivePolicy: {
+        deadLetterTargetArn: { "Fn::GetAtt": ["OrdersDlq", "Arn"] },
+        maxReceiveCount: 3,
+      },
+    },
+  },
+}
+```
+
+A message the queue gives up on reaches `orders-dlq`, and `GetQueueAttributes` on `orders` reports
+the policy back. A policy real SQS would refuse fails the resource, in the words it refuses an SDK
+caller with. Terraform's `redrive_policy` and its `aws_sqs_queue_redrive_policy` resource both map
+onto this property. A plan carrying either deploys a working dead-letter queue.
 
 A queue with no `QueueName` is named from the stack name, the logical ID and a tail derived from
 both. The queue above with its name left out would be `orders-stack-OrdersQueue-` and twelve more
@@ -1065,10 +1096,16 @@ under the name the template gave it.
 The properties this simulation has no behaviour for are a different case. The queue is created without
 them and each one is recorded in
 [`stack.ignoredProperties`](https://yulinsim.dev/services/cloudformation/#properties-a-resource-was-created-without).
-A stack full of queues still deploys. Those properties are `RedrivePolicy`, `RedriveAllowPolicy`,
-`KmsMasterKeyId`, `KmsDataKeyReusePeriodSeconds`, `SqsManagedSseEnabled`,
-`ContentBasedDeduplication`, `DeduplicationScope`, `FifoThroughputLimit` and `Tags`. A property
-outside the `AWS::SQS::Queue` schema is recorded the same way.
+A stack full of queues still deploys. Those properties are `RedriveAllowPolicy`, `KmsMasterKeyId`,
+`KmsDataKeyReusePeriodSeconds`, `SqsManagedSseEnabled`, `ContentBasedDeduplication`,
+`DeduplicationScope`, `FifoThroughputLimit` and `Tags`. A property outside the `AWS::SQS::Queue`
+schema is recorded the same way.
+
+`KmsDataKeyReusePeriodSeconds` is read for one thing before being recorded. Real SQS takes a period
+between 60 seconds and 86,400, and answers anything else with `InvalidAttributeValue`, which fails
+the stack at `CreateQueue`. Nothing here encrypts a message either way, and a queue that deployed
+with a period outside that range would report a template CloudFormation rejects as working. A period
+inside it is recorded like any other skipped property.
 
 `AWS::SQS::QueuePolicy` deploys the policy it names onto each queue in its `Queues` list, through
 `SetQueueAttributes`. A policy declared in a template is therefore validated and enforced exactly as
@@ -1123,7 +1160,8 @@ Sim SQS currently supports:
 - Lambda event source mappings, delivering messages to a simulated function and deleting the batches
   it handles
 - `AWS::SQS::Queue` and `AWS::SQS::QueuePolicy` in a CloudFormation or CDK template, with `Ref`
-  giving the queue URL and `Fn::GetAtt` giving `Arn`, `QueueName` and `QueueUrl`
+  giving the queue URL and `Fn::GetAtt` giving `Arn`, `QueueName` and `QueueUrl`, and a
+  `RedrivePolicy` on a queue naming its dead-letter queue
 
 ## Limitations
 
@@ -1152,9 +1190,6 @@ Current documented limitations:
   reading of SQS, and AWS documents no answer either way. A receive count counts receives from one
   queue, and the moved message has not been received from the dead-letter queue yet. `SentTimestamp`
   being unchanged by the move is documented AWS behaviour, and is simulated as such.
-- The `RedrivePolicy` property on `AWS::SQS::Queue` is left out, and an SDK call is what configures a
-  dead-letter queue. The queue is created without the property and the omission is recorded in
-  `stack.ignoredProperties`.
 - A queue policy is set through the `Policy` attribute only. `AddPermission` and `RemovePermission`,
   shorthands for writing one statement of it, are absent.
 - `GetQueueAttributes` reports the `Policy` string that was set. Real SQS re-serialises the document
@@ -1165,6 +1200,8 @@ Current documented limitations:
 - Encryption is left out. `KmsMasterKeyId`, `KmsDataKeyReusePeriodSeconds` and
   `SqsManagedSseEnabled` are recorded on an `AWS::SQS::Queue` and applied to nothing, and message
   bodies are held in process memory as they were sent. Anything sharing the process can read them.
+  The one thing read off them is the range on `KmsDataKeyReusePeriodSeconds`, so a template real
+  SQS refuses does not deploy here.
 - Tags are left out. `TagQueue`, `UntagQueue` and `ListQueueTags` are absent, and `CreateQueue`
   refuses a `tags` parameter rather than dropping it.
 - `SenderId` is left out, because a simulated caller has no user or role id to report it as.

package/docs/services/ssm/README.md

@@ -472,9 +472,10 @@ recorded the same way.
 references use, so a reference can sit inside a longer value and inside `Fn::Sub`.
 
 Decryption goes to simulated KMS under the key the parameter was written with, as the caller
-deploying the stack. A caller lacking `kms:Decrypt` on that key fails the resource with the
-`AccessDenied` a decrypting `GetParameter` raises (see
+deploying the stack. A caller lacking `kms:Decrypt` on a customer managed key fails the resource with
+the `AccessDenied` a decrypting `GetParameter` raises (see
 [A customer managed key needs its own permission](#a-customer-managed-key-needs-its-own-permission)).
+A parameter under the `aws/ssm` managed key needs no KMS permission of the caller.
 
 CDK writes one of these from `SecretValue.ssmSecure`, from
 `ssm.StringParameter.fromSecureStringParameterAttributes` and from the deprecated
@@ -915,24 +916,27 @@ try {
 }
 ```
 
-### The aws/ssm managed key needs kms:Decrypt too
+### The aws/ssm managed key allows the read itself
 
-A parameter naming no key is encrypted under the `aws/ssm` AWS managed key. Parameter Store supplies
-`kms:ViaService`, and that key's policy allows the account's principals to use it through Systems
-Manager. What the policy admits is whoever the request came from. Parameter Store decrypts with the
-caller's own permissions, and a decrypting read needs `kms:Decrypt` on top of `ssm:GetParameter`. A
-role holding the parameter permission alone reads the ciphertext and is refused when it asks for
-decryption, as it is in a real account.
+A parameter naming no key is encrypted under the `aws/ssm` AWS managed key. That key's policy allows
+the cryptographic actions to a wildcard principal under `kms:ViaService` and `kms:CallerAccount`
+conditions, and Parameter Store satisfies both. A grant of that shape delegates nothing to IAM. A
+role holding `ssm:GetParameter` and nothing on KMS reads the decrypted value, as it does in an
+account, and withholding that access takes an explicit `Deny`.
 
-The managed key's id is unknown when a template is synthesized. A policy scopes the grant with a
-`kms:ViaService` condition naming `ssm.<region>.amazonaws.com`, and simulated IAM evaluates that
-condition against the region the parameter belongs to.
+`GetParameters` and `GetParametersByPath` decrypt through the same path and on the same permission.
+A `SecureString` write under the managed key asks for no KMS permission either.
 
-`GetParameters` and `GetParametersByPath` decrypt through the same path, and refuse the same way for
-a caller without the key permission.
+A `kms:Decrypt` grant scoped with a `kms:ViaService` condition (the shape a stack writes when the
+key is chosen after synthesis) still works, and it is what a customer managed key wants.
 
-The same role cannot take the ciphertext to KMS itself, because the managed key's policy applies
-only to a request that reached KMS through Systems Manager.
+The key stays out of reach of anything calling KMS directly. The same role handed the stored
+ciphertext cannot decrypt it through `Decrypt`, because the policy's `kms:ViaService` condition
+matches only a request that arrived through Systems Manager. A caller in another account is refused
+by the `kms:CallerAccount` condition.
+
+An ECS task resolves a `secrets` entry through this path. An execution role holding
+`ssm:GetParameter` alone reads a managed key `SecureString` into a container's environment.
 
 ```typescript sim-ssm-secure-string-managed-key
 /**
@@ -969,26 +973,14 @@ const role = await simAws.iam().createRole(
   }),
 );
 
-// The parameter, and the key through Systems Manager.
+// The parameter, and nothing on KMS.
 await simAws.iam().putRolePolicy(
   new PutRolePolicyCommand({
     RoleName: "ConfigReader",
     PolicyName: "ReadDbPassword",
     PolicyDocument: JSON.stringify({
       Version: "2012-10-17",
-      Statement: [
-        { Effect: "Allow", Action: "ssm:GetParameter", Resource: "*" },
-        {
-          Effect: "Allow",
-          Action: "kms:Decrypt",
-          Resource: "*",
-          Condition: {
-            StringEquals: {
-              "kms:ViaService": `ssm.${simAws.defaultRegionName}.amazonaws.com`,
-            },
-          },
-        },
-      ],
+      Statement: { Effect: "Allow", Action: "ssm:GetParameter", Resource: "*" },
     }),
   }),
 );
@@ -1052,9 +1044,10 @@ Current documented limitations:
   without complaint.
 - `KeyId` on a `String` or `StringList` parameter is refused, since nothing would encrypt a value
   stored in the clear.
-- Writing a `SecureString` under the `aws/ssm` managed key asks the caller for no KMS permission,
-  where AWS documents `kms:Encrypt` for a standard tier write. A write under a customer managed key
-  does need it.
+- Reading and writing a `SecureString` under the `aws/ssm` managed key ask the caller for no KMS
+  permission, which follows that key's policy and the Parameter Store setup page. AWS's SecureString
+  encryption page documents `kms:Encrypt` and `kms:Decrypt` for either kind of key, and the two
+  disagree. A parameter under a customer managed key does need them.
 - `DataType` other than `text` is refused. Real Parameter Store validates an `aws:ec2:image` value
   against EC2, which this simulation cannot do.
 - Filters are refused outright. `GetParametersByPath` refuses `ParameterFilters`, and

package/llms.txt

@@ -14,6 +14,7 @@ The same pages are on the web at https://yulinsim.dev/ for whichever release is
 - [API Gateway HTTP APIs](docs/services/apigatewayv2/README.md): Simulated API Gateway HTTP API usage docs
 - [API Gateway REST APIs](docs/services/apigateway/README.md): Simulated API Gateway REST API usage docs
 - [Athena](docs/services/athena/README.md): Simulated Amazon Athena usage docs
+- [AWS Backup](docs/services/backup/README.md): Simulated AWS Backup usage docs
 - [Bedrock](docs/services/bedrock/README.md): Simulated Amazon Bedrock usage docs
 - [CloudFormation](docs/services/cloudformation/README.md): Simulated CloudFormation usage docs
 - [CloudFront](docs/services/cloudfront/README.md): Simulated CloudFront usage docs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.20.17",
+  "version": "1.21.1",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -65,6 +65,10 @@
       "import": "./dist/service/bedrock/index.js",
       "types": "./dist/service/bedrock/index.d.ts"
     },
+    "./backup": {
+      "import": "./dist/service/backup/index.js",
+      "types": "./dist/service/backup/index.d.ts"
+    },
     "./cloudformation": {
       "import": "./dist/service/cloudformation/index.js",
       "types": "./dist/service/cloudformation/index.d.ts"
@@ -231,6 +235,7 @@
     "@aws-sdk/client-api-gateway": "^3.1112.0",
     "@aws-sdk/client-apigatewayv2": "^3.1101.0",
     "@aws-sdk/client-athena": "^3.1115.0",
+    "@aws-sdk/client-backup": "^3.1121.0",
     "@aws-sdk/client-bedrock-runtime": "^3.1115.0",
     "@aws-sdk/client-cloudformation": "^3.1101.0",
     "@aws-sdk/client-cloudfront": "^3.1101.0",
@@ -268,7 +273,7 @@
     "@aws-sdk/lib-storage": "^3.1112.0",
     "@aws-sdk/s3-request-presigner": "^3.1101.0",
     "@eslint/js": "^10.0.1",
-    "@kensio/smartass": "^1.37.0",
+    "@kensio/smartass": "^1.37.7",
     "@semantic-release/exec": "7.1.0",
     "@smithy/signature-v4": "^5.6.12",
     "@smithy/smithy-client": "^4.14.16",