@kensio/yulin 1.21.0 → 1.21.1

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.d.ts

@@ -3,7 +3,10 @@ import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../..
  * The rule fields CloudFormation and the SDK spell differently.
  *
  * CloudFormation flattens an expiry onto the rule and names a transition's
- * timing after it, where the request nests both. Everything absent from here,
+ * timing after it, where the request nests both. It carries the noncurrent
+ * expiry both ways, as the nested object the request takes and as the older
+ * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
+ * `noncurrentVersionExpiration` synthesises. Everything absent from here,
  * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
  * object size bounds among them, is spelled the same way in both and goes
  * through untouched.
@@ -28,3 +31,17 @@ export declare function simCfnS3StatedFields(fields: Record<string, SimCfnTempla
  * acts on anyway.
  */
 export declare function simCfnS3CarriedRuleFields(rule: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;
+/**
+ * The three flattened expiry fields, gathered under the one the request
+ * carries. A rule stating none of them keeps no `Expiration` at all.
+ */
+export declare function simCfnS3RuleExpiration(rule: SimCfnTemplateValueRecord): SimCfnTemplateValue | undefined;
+/**
+ * The noncurrent expiry, from whichever of the two spellings the rule used.
+ *
+ * The nested object is the one the request takes and wins where a template
+ * states it. `NoncurrentVersionExpirationInDays` is the older flattened field
+ * beside it, and is what CDK synthesises, so a rule carrying only that one
+ * still reaches the versions it names.
+ */
+export declare function simCfnS3RuleNoncurrentExpiration(rule: SimCfnTemplateValueRecord): SimCfnTemplateValue | undefined;

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.js

@@ -2,7 +2,10 @@
  * The rule fields CloudFormation and the SDK spell differently.
  *
  * CloudFormation flattens an expiry onto the rule and names a transition's
- * timing after it, where the request nests both. Everything absent from here,
+ * timing after it, where the request nests both. It carries the noncurrent
+ * expiry both ways, as the nested object the request takes and as the older
+ * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
+ * `noncurrentVersionExpiration` synthesises. Everything absent from here,
  * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
  * object size bounds among them, is spelled the same way in both and goes
  * through untouched.
@@ -12,6 +15,8 @@ export const simCfnS3TranslatedLifecycleFields = new Set([
     "ExpirationDate",
     "ExpirationInDays",
     "ExpiredObjectDeleteMarker",
+    "NoncurrentVersionExpiration",
+    "NoncurrentVersionExpirationInDays",
     "Transition",
     "Transitions",
 ]);
@@ -47,3 +52,31 @@ export function simCfnS3StatedFields(fields) {
 export function simCfnS3CarriedRuleFields(rule) {
     return Object.fromEntries(Object.entries(rule).filter(([name]) => !simCfnS3TranslatedLifecycleFields.has(name)));
 }
+/**
+ * The three flattened expiry fields, gathered under the one the request
+ * carries. A rule stating none of them keeps no `Expiration` at all.
+ */
+export function simCfnS3RuleExpiration(rule) {
+    return simCfnS3StatedFields({
+        Date: simCfnS3LifecycleDate(rule["ExpirationDate"]),
+        Days: rule["ExpirationInDays"],
+        ExpiredObjectDeleteMarker: rule["ExpiredObjectDeleteMarker"],
+    });
+}
+/**
+ * The noncurrent expiry, from whichever of the two spellings the rule used.
+ *
+ * The nested object is the one the request takes and wins where a template
+ * states it. `NoncurrentVersionExpirationInDays` is the older flattened field
+ * beside it, and is what CDK synthesises, so a rule carrying only that one
+ * still reaches the versions it names.
+ */
+export function simCfnS3RuleNoncurrentExpiration(rule) {
+    const nested = rule["NoncurrentVersionExpiration"];
+    if (nested !== undefined) {
+        return nested;
+    }
+    return simCfnS3StatedFields({
+        NoncurrentDays: rule["NoncurrentVersionExpirationInDays"],
+    });
+}

package/dist/service/s3/cfn/bucket/lock/sim-cfn-s3-bucket-object-lock-configuration.d.ts

@@ -0,0 +1,37 @@
+import type { SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3ObjectLockConfigurationInput } from "../../../bucket/lock/sim-s3-object-lock-configuration.js";
+/**
+ * Reads the Object Lock properties of an AWS::S3::Bucket Resource.
+ *
+ * A Bucket declares Object Lock across two properties. `ObjectLockEnabled`
+ * turns it on and `ObjectLockConfiguration` carries the default retention,
+ * and real CloudFormation requires the first before it will read the second.
+ * CDK's `objectLockEnabled` and `objectLockDefaultRetention` synthesise both.
+ *
+ * The configuration is handed to PutObjectLockConfiguration rather than
+ * translated here, so a template and an SDK caller are validated identically,
+ * including the versioning a locked Bucket has to have underneath it.
+ */
+export declare class SimCfnS3BucketObjectLockConfiguration {
+    private readonly logicalId;
+    private readonly properties;
+    private readonly shape;
+    constructor(logicalId: string, properties: SimCfnTemplateValueRecord);
+    /**
+     * The configuration to apply, or nothing where the Resource declares none.
+     *
+     * A Bucket declaring `ObjectLockEnabled` and no configuration is locked with
+     * no default retention, which is a real thing to declare: every version it
+     * holds is then retained only by the requests that name one.
+     */
+    read(): SimS3ObjectLockConfigurationInput | undefined;
+    /**
+     * Whether the Resource asks for Object Lock.
+     *
+     * Real CloudFormation refuses an `ObjectLockConfiguration` on a Bucket that
+     * does not also declare `ObjectLockEnabled`, and so does this: a Bucket
+     * created around the property would report a default retention it was not
+     * applying to anything.
+     */
+    private isEnabled;
+}

package/dist/service/s3/cfn/bucket/lock/sim-cfn-s3-bucket-object-lock-configuration.js

@@ -0,0 +1,78 @@
+import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+import { simS3ObjectLockEnabled } from "../../../bucket/lock/sim-s3-object-lock-configuration.js";
+import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
+/**
+ * The AWS::S3::Bucket values that turn Object Lock on. CloudFormation carries
+ * a boolean property as either, depending on where the value came from.
+ */
+const objectLockEnabledValues = new Set([true, "true"]);
+const objectLockDisabledValues = new Set([
+    false,
+    "false",
+]);
+/**
+ * Reads the Object Lock properties of an AWS::S3::Bucket Resource.
+ *
+ * A Bucket declares Object Lock across two properties. `ObjectLockEnabled`
+ * turns it on and `ObjectLockConfiguration` carries the default retention,
+ * and real CloudFormation requires the first before it will read the second.
+ * CDK's `objectLockEnabled` and `objectLockDefaultRetention` synthesise both.
+ *
+ * The configuration is handed to PutObjectLockConfiguration rather than
+ * translated here, so a template and an SDK caller are validated identically,
+ * including the versioning a locked Bucket has to have underneath it.
+ */
+export class SimCfnS3BucketObjectLockConfiguration {
+    logicalId;
+    properties;
+    shape;
+    constructor(logicalId, properties) {
+        this.logicalId = logicalId;
+        this.properties = properties;
+        this.shape = new SimCfnValueShape((reason) => s3BucketResourceError(logicalId, reason));
+    }
+    /**
+     * The configuration to apply, or nothing where the Resource declares none.
+     *
+     * A Bucket declaring `ObjectLockEnabled` and no configuration is locked with
+     * no default retention, which is a real thing to declare: every version it
+     * holds is then retained only by the requests that name one.
+     */
+    read() {
+        if (!this.isEnabled()) {
+            return undefined;
+        }
+        const declared = this.properties["ObjectLockConfiguration"];
+        if (declared === undefined) {
+            return { ObjectLockEnabled: simS3ObjectLockEnabled };
+        }
+        return {
+            ...this.shape.record(declared, "ObjectLockConfiguration"),
+            ObjectLockEnabled: simS3ObjectLockEnabled,
+        };
+    }
+    /**
+     * Whether the Resource asks for Object Lock.
+     *
+     * Real CloudFormation refuses an `ObjectLockConfiguration` on a Bucket that
+     * does not also declare `ObjectLockEnabled`, and so does this: a Bucket
+     * created around the property would report a default retention it was not
+     * applying to anything.
+     */
+    isEnabled() {
+        const enabled = this.properties["ObjectLockEnabled"];
+        if (objectLockEnabledValues.has(enabled)) {
+            return true;
+        }
+        if (this.properties["ObjectLockConfiguration"] !== undefined &&
+            (enabled === undefined || objectLockDisabledValues.has(enabled))) {
+            throw s3BucketResourceError(this.logicalId, "ObjectLockConfiguration requires ObjectLockEnabled to be true, " +
+                "because Object Lock holds a version and a Bucket without it holds " +
+                "none");
+        }
+        if (enabled !== undefined && !objectLockDisabledValues.has(enabled)) {
+            throw s3BucketResourceError(this.logicalId, "ObjectLockEnabled must be true or false");
+        }
+        return false;
+    }
+}

package/dist/service/s3/cfn/bucket/replication/sim-cfn-s3-bucket-replication-rules.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnSkippedPropertyValue } from "../../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";
+/**
+ * The AWS::S3::Bucket ReplicationConfiguration constraints real S3 enforces.
+ *
+ * Replication itself is not simulated. The property is recorded against the
+ * Resource and the Bucket is created without it, and no Object is ever copied.
+ * What the value says is still read, because a configuration real S3 answers
+ * with a 400 otherwise deploys here and reaches CREATE_COMPLETE. A test
+ * standing on that deployment reports a template AWS refuses as working, which
+ * is the one failure a local deploy of a real template exists to catch.
+ *
+ * These are the constraints the S3 API documents and the CloudFormation
+ * Resource schema leaves out, so cfn-lint passes a template failing any of
+ * them.
+ *
+ * Attached to the property in `unsimulatedPropertyReasons`, so it runs
+ * wherever a skipped AWS::S3::Bucket property is recorded rather than from a
+ * call site of its own.
+ */
+export declare function validateSimCfnS3BucketReplication(declared: SimCfnSkippedPropertyValue): void;

package/dist/service/s3/cfn/bucket/replication/sim-cfn-s3-bucket-replication-rules.js

@@ -0,0 +1,107 @@
+import { isRecord } from "../../../../../util/type-guard/record.js";
+/**
+ * The AWS::S3::Bucket ReplicationConfiguration constraints real S3 enforces.
+ *
+ * Replication itself is not simulated. The property is recorded against the
+ * Resource and the Bucket is created without it, and no Object is ever copied.
+ * What the value says is still read, because a configuration real S3 answers
+ * with a 400 otherwise deploys here and reaches CREATE_COMPLETE. A test
+ * standing on that deployment reports a template AWS refuses as working, which
+ * is the one failure a local deploy of a real template exists to catch.
+ *
+ * These are the constraints the S3 API documents and the CloudFormation
+ * Resource schema leaves out, so cfn-lint passes a template failing any of
+ * them.
+ *
+ * Attached to the property in `unsimulatedPropertyReasons`, so it runs
+ * wherever a skipped AWS::S3::Bucket property is recorded rather than from a
+ * call site of its own.
+ */
+export function validateSimCfnS3BucketReplication(declared) {
+    const configuration = declared.value;
+    if (!isRecord(configuration)) {
+        return;
+    }
+    refuseUnversionedSource(declared);
+    const rules = configuration["Rules"];
+    if (!Array.isArray(rules)) {
+        return;
+    }
+    rules.forEach((rule, index) => {
+        validateRule(declared, rule, `ReplicationConfiguration Rules[${index}]`);
+    });
+}
+/**
+ * Refuse replication on a Bucket that keeps one version of an Object.
+ *
+ * Real S3 requires versioning on the source Bucket and on the destination.
+ * Only the source is checked, and it is read from the template rather than
+ * from the Bucket, because `VersioningConfiguration` is skipped too and no
+ * simulated Bucket carries a versioning state to read. The destination is a
+ * Bucket ARN that may belong to another Stack or another Account, so there is
+ * nothing here to read it from at all.
+ */
+function refuseUnversionedSource(declared) {
+    const versioning = declared.properties["VersioningConfiguration"];
+    if (isRecord(versioning) && versioning["Status"] === "Enabled") {
+        return;
+    }
+    declared.refuse("Versioning must be Enabled on the Bucket to apply a " +
+        "ReplicationConfiguration");
+}
+function validateRule(declared, rule, path) {
+    if (!isRecord(rule)) {
+        return;
+    }
+    refuseEventThresholdWithoutReplicationTime(declared, rule, path);
+    refuseFilterWithoutItsCompanions(declared, rule, path);
+}
+/**
+ * Refuse a replication metrics threshold on a rule that has not turned
+ * Replication Time Control on.
+ *
+ * `Metrics.EventThreshold` says when to raise
+ * `s3:Replication:OperationMissedThreshold`, which only S3 RTC measures
+ * against. CDK renders `ReplicationTimeValue.FIFTEEN_MINUTES` passed as
+ * `metrics` into the threshold on its own, so this reaches a template through
+ * an ordinary L2 call.
+ */
+function refuseEventThresholdWithoutReplicationTime(declared, rule, path) {
+    const destination = rule["Destination"];
+    if (!isRecord(destination)) {
+        return;
+    }
+    const metrics = destination["Metrics"];
+    if (!isRecord(metrics) || metrics["EventThreshold"] === undefined) {
+        return;
+    }
+    const replicationTime = destination["ReplicationTime"];
+    if (isRecord(replicationTime) && replicationTime["Status"] === "Enabled") {
+        return;
+    }
+    declared.refuse(`${path} Destination Metrics cannot contain an event threshold when ` +
+        "ReplicationTime is not specified or Disabled");
+}
+/**
+ * Refuse a rule stating a Filter without the fields S3 requires alongside one.
+ *
+ * The S3 API documents `DeleteMarkerReplication`, `Status` and `Priority` as
+ * required alongside `Filter`. A rule carrying the older `Prefix` instead needs
+ * none of them, so the check is on `Filter` rather than on the rule.
+ */
+function refuseFilterWithoutItsCompanions(declared, rule, path) {
+    if (rule["Filter"] === undefined) {
+        return;
+    }
+    const missing = [
+        ["DeleteMarkerReplication", rule["DeleteMarkerReplication"]],
+        ["Priority", rule["Priority"]],
+        ["Status", rule["Status"]],
+    ]
+        .filter(([, value]) => value === undefined)
+        .map(([name]) => name);
+    if (missing.length === 0) {
+        return;
+    }
+    declared.refuse(`${path} states a Filter, which requires ${missing.join(", ")} as well`);
+}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-configurator.d.ts

@@ -1,7 +1,7 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimS3 } from "../../sim-s3.js";
-import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 interface SimCfnS3BucketConfiguratorProperties {
     readonly simS3: SimS3;
     readonly resource: SimCfnResource;
@@ -22,18 +22,25 @@ export declare class SimCfnS3BucketConfigurator {
     private readonly properties;
     private readonly bucketName;
     private readonly options;
+    private readonly declared;
     constructor(properties: SimCfnS3BucketConfiguratorProperties);
     /**
      * Apply every configuration the Resource declares.
      *
-     * Notifications go last, because S3 checks every destination the
-     * configuration names, and the Resources those destinations live on have to
-     * exist by then.
+     * Versioning goes before Object Lock and before the lifecycle rules,
+     * because both describe a Bucket that keeps versions and Object Lock refuses
+     * one that does not. Notifications go last, because S3 checks every
+     * destination the configuration names, and the Resources those destinations
+     * live on have to exist by then.
      */
     configure(): Promise<void>;
-    private configureWebsite;
-    private configurePublicAccess;
-    private configureLifecycle;
+    /**
+     * Apply the event notification configuration the Resource declares.
+     *
+     * This reader takes the declared value rather than the whole property bag,
+     * because a notification configuration also arrives from a CDK custom
+     * resource that has no AWS::S3::Bucket properties to read it out of.
+     */
     private configureNotifications;
 }
 export {};

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-configurator.js

@@ -1,7 +1,5 @@
-import { SimCfnS3BucketLifecycleConfiguration } from "./lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js";
 import { SimCfnS3BucketNotificationConfiguration } from "./notification/sim-cfn-s3-bucket-notification-configuration.js";
-import { SimCfnS3BucketPublicAccessConfiguration } from "./public-access/sim-cfn-s3-bucket-public-access-configuration.js";
-import { SimCfnS3BucketWebsiteConfiguration } from "./website/sim-cfn-s3-bucket-website-configuration.js";
+import { SimCfnS3BucketDeclaredConfigurations } from "./sim-cfn-s3-bucket-declared-configurations.js";
 /**
  * Applies the configurations an AWS::S3::Bucket Resource declares to the
  * Bucket that was created for it.
@@ -15,58 +13,52 @@ export class SimCfnS3BucketConfigurator {
     properties;
     bucketName;
     options;
+    declared;
     constructor(properties) {
         this.simS3 = properties.simS3;
         this.resource = properties.resource;
         this.properties = properties.properties;
         this.bucketName = properties.bucketName;
         this.options = properties.options;
+        this.declared = new SimCfnS3BucketDeclaredConfigurations({
+            simS3: this.simS3,
+            logicalId: this.resource.logicalId,
+            properties: this.properties,
+            bucketName: this.bucketName,
+            options: this.options,
+        });
     }
     /**
      * Apply every configuration the Resource declares.
      *
-     * Notifications go last, because S3 checks every destination the
-     * configuration names, and the Resources those destinations live on have to
-     * exist by then.
+     * Versioning goes before Object Lock and before the lifecycle rules,
+     * because both describe a Bucket that keeps versions and Object Lock refuses
+     * one that does not. Notifications go last, because S3 checks every
+     * destination the configuration names, and the Resources those destinations
+     * live on have to exist by then.
      */
     async configure() {
-        await this.configureWebsite();
-        await this.configurePublicAccess();
-        await this.configureLifecycle();
+        await this.declared.applyWebsite();
+        await this.declared.applyPublicAccess();
+        await this.declared.applyVersioning();
+        await this.declared.applyObjectLock();
+        await this.declared.applyLifecycle();
         await this.configureNotifications();
     }
-    async configureWebsite() {
-        const config = new SimCfnS3BucketWebsiteConfiguration(this.resource.logicalId, this.properties).read();
-        if (config === undefined) {
-            return;
-        }
-        await this.simS3.putBucketWebsite({ input: { Bucket: this.bucketName, WebsiteConfiguration: config } }, this.options);
-    }
-    async configurePublicAccess() {
-        const config = new SimCfnS3BucketPublicAccessConfiguration(this.resource.logicalId, this.properties).read();
-        if (config === undefined) {
-            return;
-        }
-        await this.simS3.putPublicAccessBlock({
-            input: {
-                Bucket: this.bucketName,
-                PublicAccessBlockConfiguration: config,
-            },
-        }, this.options);
-    }
-    async configureLifecycle() {
-        const config = new SimCfnS3BucketLifecycleConfiguration(this.resource.logicalId, this.properties).read();
-        if (config === undefined) {
-            return;
-        }
-        await this.simS3.putBucketLifecycleConfiguration({ input: { Bucket: this.bucketName, LifecycleConfiguration: config } }, this.options);
-    }
+    /**
+     * Apply the event notification configuration the Resource declares.
+     *
+     * This reader takes the declared value rather than the whole property bag,
+     * because a notification configuration also arrives from a CDK custom
+     * resource that has no AWS::S3::Bucket properties to read it out of.
+     */
     async configureNotifications() {
         const declared = this.properties["NotificationConfiguration"];
         if (declared === undefined) {
             return;
         }
-        const config = new SimCfnS3BucketNotificationConfiguration(this.resource.logicalId).read(declared);
-        await this.simS3.putBucketNotificationConfiguration({ input: { Bucket: this.bucketName, NotificationConfiguration: config } }, this.options);
+        const reader = new SimCfnS3BucketNotificationConfiguration(this.resource.logicalId);
+        const NotificationConfiguration = reader.read(declared);
+        await this.simS3.putBucketNotificationConfiguration({ input: { Bucket: this.bucketName, NotificationConfiguration } }, this.options);
     }
 }

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.d.ts

@@ -0,0 +1,62 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3 } from "../../sim-s3.js";
+interface SimCfnS3BucketDeclaredConfigurationsProperties {
+    readonly simS3: SimS3;
+    readonly logicalId: string;
+    readonly properties: SimCfnTemplateValueRecord;
+    readonly bucketName: string;
+    readonly options: SimCfnResourceCallerOptions;
+}
+/**
+ * The AWS::S3::Bucket properties that are read straight off the Resource and
+ * handed to a command.
+ *
+ * Five properties with one shape between them. Each is read from the Resource,
+ * left alone where the Resource omitted it, and otherwise applied through the
+ * command an SDK caller would reach, so a template and an SDK caller are
+ * validated identically. The event notification configuration is the one that
+ * does not fit, because it also arrives from a CDK custom resource with no
+ * Bucket properties behind it, so it stays with the configurator.
+ */
+export declare class SimCfnS3BucketDeclaredConfigurations {
+    private readonly simS3;
+    private readonly logicalId;
+    private readonly properties;
+    private readonly bucketName;
+    private readonly options;
+    constructor(properties: SimCfnS3BucketDeclaredConfigurationsProperties);
+    /**
+     * Apply the website configuration the Resource declares.
+     */
+    applyWebsite(): Promise<void>;
+    /**
+     * Apply the Block Public Access settings the Resource declares.
+     */
+    applyPublicAccess(): Promise<void>;
+    /**
+     * Apply the versioning configuration the Resource declares.
+     */
+    applyVersioning(): Promise<void>;
+    /**
+     * Apply the Object Lock configuration the Resource declares.
+     *
+     * This goes after versioning, because Object Lock holds a version and
+     * PutObjectLockConfiguration refuses a Bucket that keeps none. A template
+     * declaring Object Lock without versioning therefore fails the Resource, in
+     * the words an SDK caller is refused in.
+     */
+    applyObjectLock(): Promise<void>;
+    /**
+     * Apply the lifecycle rules the Resource declares.
+     */
+    applyLifecycle(): Promise<void>;
+    /**
+     * Read one declared property, or nothing where the Resource omitted it.
+     *
+     * Every reader is built the same way, from the logical ID that names the
+     * Resource in a failure and the properties the Resource declared.
+     */
+    private read;
+}
+export {};

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.js

@@ -0,0 +1,89 @@
+import { SimCfnS3BucketLifecycleConfiguration } from "./lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js";
+import { SimCfnS3BucketObjectLockConfiguration } from "./lock/sim-cfn-s3-bucket-object-lock-configuration.js";
+import { SimCfnS3BucketPublicAccessConfiguration } from "./public-access/sim-cfn-s3-bucket-public-access-configuration.js";
+import { SimCfnS3BucketVersioningConfiguration } from "./versioning/sim-cfn-s3-bucket-versioning-configuration.js";
+import { SimCfnS3BucketWebsiteConfiguration } from "./website/sim-cfn-s3-bucket-website-configuration.js";
+/**
+ * The AWS::S3::Bucket properties that are read straight off the Resource and
+ * handed to a command.
+ *
+ * Five properties with one shape between them. Each is read from the Resource,
+ * left alone where the Resource omitted it, and otherwise applied through the
+ * command an SDK caller would reach, so a template and an SDK caller are
+ * validated identically. The event notification configuration is the one that
+ * does not fit, because it also arrives from a CDK custom resource with no
+ * Bucket properties behind it, so it stays with the configurator.
+ */
+export class SimCfnS3BucketDeclaredConfigurations {
+    simS3;
+    logicalId;
+    properties;
+    bucketName;
+    options;
+    constructor(properties) {
+        this.simS3 = properties.simS3;
+        this.logicalId = properties.logicalId;
+        this.properties = properties.properties;
+        this.bucketName = properties.bucketName;
+        this.options = properties.options;
+    }
+    /**
+     * Apply the website configuration the Resource declares.
+     */
+    async applyWebsite() {
+        const WebsiteConfiguration = this.read(SimCfnS3BucketWebsiteConfiguration);
+        if (WebsiteConfiguration !== undefined) {
+            await this.simS3.putBucketWebsite({ input: { Bucket: this.bucketName, WebsiteConfiguration } }, this.options);
+        }
+    }
+    /**
+     * Apply the Block Public Access settings the Resource declares.
+     */
+    async applyPublicAccess() {
+        const PublicAccessBlockConfiguration = this.read(SimCfnS3BucketPublicAccessConfiguration);
+        if (PublicAccessBlockConfiguration !== undefined) {
+            await this.simS3.putPublicAccessBlock({ input: { Bucket: this.bucketName, PublicAccessBlockConfiguration } }, this.options);
+        }
+    }
+    /**
+     * Apply the versioning configuration the Resource declares.
+     */
+    async applyVersioning() {
+        const VersioningConfiguration = this.read(SimCfnS3BucketVersioningConfiguration);
+        if (VersioningConfiguration !== undefined) {
+            await this.simS3.putBucketVersioning({ input: { Bucket: this.bucketName, VersioningConfiguration } }, this.options);
+        }
+    }
+    /**
+     * Apply the Object Lock configuration the Resource declares.
+     *
+     * This goes after versioning, because Object Lock holds a version and
+     * PutObjectLockConfiguration refuses a Bucket that keeps none. A template
+     * declaring Object Lock without versioning therefore fails the Resource, in
+     * the words an SDK caller is refused in.
+     */
+    async applyObjectLock() {
+        const ObjectLockConfiguration = this.read(SimCfnS3BucketObjectLockConfiguration);
+        if (ObjectLockConfiguration !== undefined) {
+            await this.simS3.putObjectLockConfiguration({ input: { Bucket: this.bucketName, ObjectLockConfiguration } }, this.options);
+        }
+    }
+    /**
+     * Apply the lifecycle rules the Resource declares.
+     */
+    async applyLifecycle() {
+        const LifecycleConfiguration = this.read(SimCfnS3BucketLifecycleConfiguration);
+        if (LifecycleConfiguration !== undefined) {
+            await this.simS3.putBucketLifecycleConfiguration({ input: { Bucket: this.bucketName, LifecycleConfiguration } }, this.options);
+        }
+    }
+    /**
+     * Read one declared property, or nothing where the Resource omitted it.
+     *
+     * Every reader is built the same way, from the logical ID that names the
+     * Resource in a failure and the properties the Resource declared.
+     */
+    read(Reader) {
+        return new Reader(this.logicalId, this.properties).read();
+    }
+}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.d.ts

@@ -12,14 +12,18 @@ export declare const simulatedPropertyNames: ReadonlySet<string>;
  * report of differences that make no difference is one nobody can read.
  */
 export declare const inertPropertyNames: ReadonlySet<string>;
+import type { SimCfnSkippedPropertyRules } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";
 /**
  * Real AWS::S3::Bucket properties this simulation does not model, with what
  * each of them would have changed.
  *
  * The Bucket is created without them and each one is recorded against the
- * Resource. A versioned Bucket, for instance, answers a delete with a delete
- * marker and an `ObjectRemoved:DeleteMarkerCreated` event, where this simulator
- * removes the Object and raises `ObjectRemoved:Delete`, so a test written
- * against versioning needs to find out that it was never configured.
+ * Resource. A Bucket declaring replication, for instance, copies nothing to
+ * the Bucket it names, so a test expecting an Object to arrive there needs to
+ * find out that nothing was ever going to send it.
+ *
+ * A property whose value real S3 answers with a 400 states what it has to
+ * satisfy here as well. Nothing acts on the value either way, and reading it
+ * this far is what keeps a template AWS refuses from deploying.
  */
-export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+export declare const unsimulatedPropertyReasons: SimCfnSkippedPropertyRules;