@kensio/yulin 1.21.11 → 1.21.13

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts

@@ -22,6 +22,15 @@ export interface SimWafInspectedRequest {
     readonly host: string;
     /** The request body, or nothing when the request carried none. */
     readonly body: Uint8Array | undefined;
+    /**
+     * How many bytes of the body a rule inspecting it reads.
+     *
+     * This travels with the request because it belongs to the resource the
+     * request reached rather than to the rule. A rule is compiled once, when the
+     * web ACL is written, and the same compiled rule then runs in front of a
+     * distribution and a REST API stage with a different limit for each.
+     */
+    readonly bodyInspectionLimitBytes: number;
     /** The labels the rules that have run so far added to this request. */
     readonly labels: SimWafRequestLabels;
 }
@@ -36,5 +45,9 @@ export interface SimWafInspectedRequest {
  * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
  * the raw Host header would see that suffix on every request that reached
  * anything at all.
+ *
+ * The body inspection limit defaults to the 16 KB every resource type this
+ * simulation protects reads by default. A web ACL raising it with
+ * `AssociationConfig` passes the raised figure in.
  */
-export declare function simWafInspectedRequest(request: Request, body?: Uint8Array): SimWafInspectedRequest;
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number): SimWafInspectedRequest;

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js

@@ -1,4 +1,5 @@
 import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { simWafBodyInspectionLimitBytes } from "../web-acl/sim-waf-association-config.js";
 import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
 /**
  * Read the parts of an HTTP request that a web ACL inspects.
@@ -11,8 +12,12 @@ import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
  * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
  * the raw Host header would see that suffix on every request that reached
  * anything at all.
+ *
+ * The body inspection limit defaults to the 16 KB every resource type this
+ * simulation protects reads by default. A web ACL raising it with
+ * `AssociationConfig` passes the raised figure in.
  */
-export function simWafInspectedRequest(request, body) {
+export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes) {
     const url = new URL(request.url);
     return {
         method: request.method,
@@ -24,6 +29,7 @@ export function simWafInspectedRequest(request, body) {
         headers: request.headers,
         host: simAwsRequestHostname(request),
         body,
+        bodyInspectionLimitBytes,
         labels: new SimWafRequestLabels(),
     };
 }

package/dist/service/wafv2/index.d.ts

@@ -29,7 +29,8 @@ export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
 export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
-export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { type SimWafAssociationConfigInput, type SimWafBodyInspectionResourceType, simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export type { SimWafRateBasedStatementInput } from "./statement/sim-waf-rate-based.type.js";
 export type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, type SimWafErrorMetadata, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/index.js

@@ -19,5 +19,6 @@ export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
 export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
-export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/managed/sim-waf-managed-request.js

@@ -1,4 +1,3 @@
-import { simWafInspectionLimitBytes } from "../statement/sim-waf-field-content.js";
 import { simWafQueryArguments } from "../statement/sim-waf-request-fields.js";
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -22,7 +21,7 @@ export function simWafManagedRequestParts(request) {
         headerValues: [...request.headers].map(([, value]) => value),
         userAgent: request.headers.get("user-agent") ?? undefined,
         cookieHeader,
-        body: decoder.decode(body.subarray(0, simWafInspectionLimitBytes)),
+        body: decoder.decode(body.subarray(0, request.bodyInspectionLimitBytes)),
         uriPathBytes: simWafByteLength(request.uriPath),
         queryStringBytes: simWafByteLength(request.queryString),
         cookieHeaderBytes: simWafByteLength(cookieHeader),

package/dist/service/wafv2/sim-wafv2.js

@@ -89,7 +89,8 @@ export class SimWafV2 extends SimWafSets {
             throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
                 `doesn't exist: web ACL ${evaluation.webAclArn}.`);
         }
-        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body));
+        const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
+        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
     }
     /**
      * What the AWS managed rule groups do here, and what a test declares of

package/dist/service/wafv2/statement/sim-waf-field-content.d.ts

@@ -15,13 +15,13 @@ export type SimWafFieldContent = {
     readonly outcome: "noMatch";
 };
 /**
- * How much of a request body, header set or cookie set WAF reads.
+ * How much of a header set or a cookie set WAF reads.
  *
- * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
- * association can raise the body limit, which is settled where associations
- * are, so this is the one figure until then.
+ * Real WAF stops at 8 KB and 200 entries for both, whatever the web ACL is in
+ * front of. A body is the component whose limit varies by resource type, and
+ * `simWafBodyInspectionLimitBytes` carries that one.
  */
-export declare const simWafInspectionLimitBytes = 8192;
+export declare const simWafHeaderInspectionLimitBytes = 8192;
 /**
  * What a rule does about content too large for WAF to read.
  */
@@ -37,5 +37,8 @@ export declare function requiredSimWafOversizeHandling(handling: string | undefi
  * settle the statement without looking, and `CONTINUE` inspects as much as WAF
  * would have read: whole entries while they fit, and the first entry cut to
  * the limit when even one does not.
+ *
+ * The limit is passed in because a body's varies with the resource type the
+ * request reached, while a header set and a cookie set are always 8 KB.
  */
-export declare function simWafFieldContent(candidates: readonly string[], oversizeHandling: SimWafOversizeHandling): SimWafFieldContent;
+export declare function simWafFieldContent(candidates: readonly string[], oversizeHandling: SimWafOversizeHandling, limitBytes: number): SimWafFieldContent;

package/dist/service/wafv2/statement/sim-waf-field-content.js

@@ -1,12 +1,12 @@
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
 /**
- * How much of a request body, header set or cookie set WAF reads.
+ * How much of a header set or a cookie set WAF reads.
  *
- * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
- * association can raise the body limit, which is settled where associations
- * are, so this is the one figure until then.
+ * Real WAF stops at 8 KB and 200 entries for both, whatever the web ACL is in
+ * front of. A body is the component whose limit varies by resource type, and
+ * `simWafBodyInspectionLimitBytes` carries that one.
  */
-export const simWafInspectionLimitBytes = 8192;
+export const simWafHeaderInspectionLimitBytes = 8192;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 /**
@@ -26,24 +26,30 @@ export function requiredSimWafOversizeHandling(handling, ruleName) {
  * settle the statement without looking, and `CONTINUE` inspects as much as WAF
  * would have read: whole entries while they fit, and the first entry cut to
  * the limit when even one does not.
+ *
+ * The limit is passed in because a body's varies with the resource type the
+ * request reached, while a header set and a cookie set are always 8 KB.
  */
-export function simWafFieldContent(candidates, oversizeHandling) {
+export function simWafFieldContent(candidates, oversizeHandling, limitBytes) {
     const encoded = candidates.map((candidate) => encoder.encode(candidate));
     const total = encoded.reduce((sum, bytes) => sum + bytes.length, 0);
-    if (total <= simWafInspectionLimitBytes) {
+    if (total <= limitBytes) {
         return { outcome: "inspect", candidates };
     }
     if (oversizeHandling !== "CONTINUE") {
         return { outcome: oversizeHandling === "MATCH" ? "match" : "noMatch" };
     }
-    return { outcome: "inspect", candidates: readWithinLimit(encoded) };
+    return {
+        outcome: "inspect",
+        candidates: readWithinLimit(encoded, limitBytes),
+    };
 }
 /**
  * The content WAF would have read before it stopped.
  */
-function readWithinLimit(encoded) {
+function readWithinLimit(encoded, limitBytes) {
     const read = [];
-    let budget = simWafInspectionLimitBytes;
+    let budget = limitBytes;
     for (const bytes of encoded) {
         if (budget === 0) {
             break;

package/dist/service/wafv2/statement/sim-waf-set-field.js

@@ -1,4 +1,4 @@
-import { requiredSimWafOversizeHandling, simWafFieldContent, } from "./sim-waf-field-content.js";
+import { requiredSimWafOversizeHandling, simWafFieldContent, simWafHeaderInspectionLimitBytes, } from "./sim-waf-field-content.js";
 import { requiredSimWafPatternSelection } from "./sim-waf-match-pattern.js";
 import { requiredSimWafMatchScope, simWafCookies, simWafHeaderEntries, simWafPatternCandidates, } from "./sim-waf-request-fields.js";
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
@@ -22,7 +22,7 @@ export function compileSimWafSetField(field, ruleName) {
         invalidSimWafRule(ruleName, "FieldToMatch names no field to match on");
     }
     const oversize = requiredSimWafOversizeHandling(field.Body.OversizeHandling, ruleName);
-    return (request) => simWafFieldContent(request.body === undefined ? [] : [decoder.decode(request.body)], oversize);
+    return (request) => simWafFieldContent(request.body === undefined ? [] : [decoder.decode(request.body)], oversize, request.bodyInspectionLimitBytes);
 }
 function entriesReader(input, ruleName, entries) {
     const matchScope = requiredSimWafMatchScope(input.MatchScope, ruleName);
@@ -32,5 +32,5 @@ function entriesReader(input, ruleName, entries) {
         entries: entries(request),
         selection,
         matchScope,
-    }), oversize);
+    }), oversize, simWafHeaderInspectionLimitBytes);
 }

package/dist/service/wafv2/web-acl/sim-waf-association-config.d.ts

@@ -0,0 +1,54 @@
+/**
+ * A resource type whose body inspection limit a web ACL can set.
+ *
+ * Real WAF keys `AssociationConfig.RequestBody` by resource type, and these
+ * three are the ones a web ACL goes in front of here. `APP_RUNNER_SERVICE` and
+ * `VERIFIED_ACCESS_INSTANCE` are keys AWS takes for resources this simulation
+ * has no association for.
+ */
+export type SimWafBodyInspectionResourceType = "CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL";
+/**
+ * How much of a request body WAF reads for a resource type given no
+ * `AssociationConfig`.
+ *
+ * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
+ * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
+ * of either one here.
+ */
+export declare const simWafBodyInspectionLimitBytes = 16384;
+/**
+ * One resource type's entry under `AssociationConfig.RequestBody`.
+ */
+export interface SimWafRequestBodyConfigInput {
+    readonly DefaultSizeInspectionLimit?: string | undefined;
+}
+/**
+ * The `AssociationConfig` a web ACL is written with.
+ */
+export interface SimWafAssociationConfigInput {
+    readonly RequestBody?: Readonly<Record<string, SimWafRequestBodyConfigInput | undefined>> | undefined;
+}
+/**
+ * How much of a request body a web ACL's rules read, by resource type.
+ *
+ * A web ACL holds one of these whether or not it was written with an
+ * `AssociationConfig`, and a resource type the config left out reads the
+ * default 16 KB.
+ */
+export declare class SimWafBodyInspectionLimits {
+    private readonly limits;
+    private constructor();
+    /**
+     * Read the limits an `AssociationConfig` sets, refusing anything WAF would
+     * refuse and anything this simulation cannot apply.
+     */
+    static read(input: SimWafAssociationConfigInput | undefined): SimWafBodyInspectionLimits;
+    /**
+     * How many bytes of a body a request reaching one resource type is inspected
+     * for.
+     *
+     * A request evaluated against a web ACL that no resource holds names no
+     * resource type, and reads the default.
+     */
+    bytesFor(resourceType: SimWafBodyInspectionResourceType | undefined): number;
+}

package/dist/service/wafv2/web-acl/sim-waf-association-config.js

@@ -0,0 +1,92 @@
+import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+/**
+ * How much of a request body WAF reads for a resource type given no
+ * `AssociationConfig`.
+ *
+ * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
+ * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
+ * of either one here.
+ */
+export const simWafBodyInspectionLimitBytes = 16_384;
+/**
+ * The four sizes `DefaultSizeInspectionLimit` names, in bytes.
+ */
+const inspectionLimits = new Map([
+    ["KB_16", 16_384],
+    ["KB_32", 32_768],
+    ["KB_48", 49_152],
+    ["KB_64", 65_536],
+]);
+const simulatedResourceTypes = [
+    "CLOUDFRONT",
+    "API_GATEWAY",
+    "COGNITO_USER_POOL",
+];
+/**
+ * How much of a request body a web ACL's rules read, by resource type.
+ *
+ * A web ACL holds one of these whether or not it was written with an
+ * `AssociationConfig`, and a resource type the config left out reads the
+ * default 16 KB.
+ */
+export class SimWafBodyInspectionLimits {
+    limits;
+    constructor(limits) {
+        this.limits = limits;
+    }
+    /**
+     * Read the limits an `AssociationConfig` sets, refusing anything WAF would
+     * refuse and anything this simulation cannot apply.
+     */
+    static read(input) {
+        const configured = Object.entries(input?.RequestBody ?? {});
+        const limits = new Map();
+        for (const [resourceType, config] of configured) {
+            limits.set(simulatedResourceType(resourceType), inspectionLimit(resourceType, config));
+        }
+        return new SimWafBodyInspectionLimits(limits);
+    }
+    /**
+     * How many bytes of a body a request reaching one resource type is inspected
+     * for.
+     *
+     * A request evaluated against a web ACL that no resource holds names no
+     * resource type, and reads the default.
+     */
+    bytesFor(resourceType) {
+        if (resourceType === undefined) {
+            return simWafBodyInspectionLimitBytes;
+        }
+        return this.limits.get(resourceType) ?? simWafBodyInspectionLimitBytes;
+    }
+}
+/**
+ * Hold a `RequestBody` key to the resource types this simulation associates.
+ */
+function simulatedResourceType(resourceType) {
+    const simulated = simulatedResourceTypes.find((candidate) => candidate === resourceType);
+    if (simulated === undefined) {
+        throw new SimWafUnsimulatedInputException(`AssociationConfig sets the body inspection limit for ${resourceType} ` +
+            `resources, and ${simulatedResourceTypes.join(" and ")} are the ` +
+            `types a web ACL goes in front of in Yulin`);
+    }
+    return simulated;
+}
+/**
+ * Read one resource type's `DefaultSizeInspectionLimit`.
+ *
+ * An entry carrying no size is refused the same way one carrying a size WAF
+ * has no setting for is. A template writes this part of a web ACL by hand, and
+ * an entry that says nothing about the limit it is there to set is a mistake
+ * worth reporting as one.
+ */
+function inspectionLimit(resourceType, config) {
+    const limit = config?.DefaultSizeInspectionLimit;
+    const bytes = limit === undefined ? undefined : inspectionLimits.get(limit);
+    if (bytes === undefined) {
+        throw new SimWafInvalidParameterException(`Error reason: The DefaultSizeInspectionLimit ${String(limit)} is one ` +
+            `of ${inspectionLimits.keys().toArray().join(", ")}, field: ` +
+            `ASSOCIATION_CONFIG, parameter: ${resourceType}`);
+    }
+    return bytes;
+}

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.d.ts

@@ -1,4 +1,5 @@
 import { SimWafAction } from "./sim-waf-action.js";
+import type { SimWafAssociationConfigInput } from "./sim-waf-association-config.js";
 import type { SimWafActionInput } from "./sim-waf-action.type.js";
 import type { SimWafCustomResponseBodies } from "./sim-waf-custom-response.type.js";
 import type { SimWafRuleInput } from "./sim-waf-rule.type.js";
@@ -11,6 +12,7 @@ export interface SimWafWebAclConfiguration {
     readonly customResponseBodies?: SimWafCustomResponseBodies | undefined;
     readonly visibilityConfig?: unknown;
     readonly description?: string | undefined;
+    readonly associationConfig?: SimWafAssociationConfigInput | undefined;
 }
 /**
  * Read the action a request no rule claims is given.

package/dist/service/wafv2/web-acl/sim-waf-web-acl.d.ts

@@ -1,6 +1,7 @@
 import { type SimWafDecision } from "../evaluate/sim-waf-decision.js";
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
+import { type SimWafBodyInspectionResourceType } from "./sim-waf-association-config.js";
 import type { SimWafWebAclRuleScope } from "./sim-waf-rule.type.js";
 import { type SimWafWebAclConfiguration } from "./sim-waf-web-acl-configuration.js";
 interface SimWafWebAclProperties extends SimWafResourceProperties, SimWafWebAclRuleScope {
@@ -43,6 +44,14 @@ export declare class SimWafWebAcl extends SimWafResource {
      * refuses an update keeps the rules it had rather than being left with none.
      */
     reconfigure(configuration: SimWafWebAclConfiguration, lockToken: string | undefined): void;
+    /**
+     * How many bytes of a request body this web ACL reads in front of one
+     * resource type.
+     *
+     * `AssociationConfig` raises it per resource type, and a web ACL written
+     * without one reads the 16 KB default everything it protects has.
+     */
+    bodyInspectionLimitBytes(resourceType: SimWafBodyInspectionResourceType | undefined): number;
     /**
      * Decide what happens to one request.
      */

package/dist/service/wafv2/web-acl/sim-waf-web-acl.js

@@ -1,6 +1,7 @@
 import { simWafDecision, } from "../evaluate/sim-waf-decision.js";
 import { simWafEvaluateRules } from "../evaluate/sim-waf-evaluate-rules.js";
 import { SimWafResource, } from "../resource/sim-waf-resource.js";
+import { SimWafBodyInspectionLimits, } from "./sim-waf-association-config.js";
 import { compileSimWafWebAclRules } from "./sim-waf-rules.js";
 import { simWafWebAclCapacity } from "./sim-waf-web-acl-capacity.js";
 import { readSimWafDefaultAction, } from "./sim-waf-web-acl-configuration.js";
@@ -29,6 +30,7 @@ export class SimWafWebAcl extends SimWafResource {
     #defaultAction;
     #rules;
     #capacity;
+    #bodyInspectionLimits;
     constructor(properties) {
         super("webacl", properties);
         this.#scope = properties;
@@ -36,6 +38,7 @@ export class SimWafWebAcl extends SimWafResource {
         this.#defaultAction = readSimWafDefaultAction(properties.configuration);
         this.#rules = compileSimWafWebAclRules(properties.configuration, this.#scope);
         this.#capacity = simWafWebAclCapacity(properties.configuration.rules);
+        this.#bodyInspectionLimits = SimWafBodyInspectionLimits.read(properties.configuration.associationConfig);
         this.labelNamespace =
             `awswaf:${properties.accountRegionScope.accountId}:webacl:` +
                 `${properties.name}:`;
@@ -61,12 +64,24 @@ export class SimWafWebAcl extends SimWafResource {
     reconfigure(configuration, lockToken) {
         const defaultAction = readSimWafDefaultAction(configuration);
         const rules = compileSimWafWebAclRules(configuration, this.#scope);
+        const bodyInspectionLimits = SimWafBodyInspectionLimits.read(configuration.associationConfig);
         this.takeLock(lockToken);
         this.replaceDescription(configuration.description);
         this.#configuration = configuration;
         this.#defaultAction = defaultAction;
         this.#rules = rules;
         this.#capacity = simWafWebAclCapacity(configuration.rules);
+        this.#bodyInspectionLimits = bodyInspectionLimits;
+    }
+    /**
+     * How many bytes of a request body this web ACL reads in front of one
+     * resource type.
+     *
+     * `AssociationConfig` raises it per resource type, and a web ACL written
+     * without one reads the 16 KB default everything it protects has.
+     */
+    bodyInspectionLimitBytes(resourceType) {
+        return this.#bodyInspectionLimits.bytesFor(resourceType);
     }
     /**
      * Decide what happens to one request.

package/docs/services/dynamodb/README.md

@@ -3637,6 +3637,101 @@ unauthorized caller cannot find out which names are taken.
 in the same way, each against the `dynamodb:` action of its own name. `ListTables` names no table.
 It authorizes against `*`.
 
+### Fine-grained access control with dynamodb:LeadingKeys
+
+`GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`, `DeleteItem` and `BatchWriteItem`
+supply the partition key values they reach as `dynamodb:LeadingKeys`. A policy conditioned on that
+key restricts a caller to the items under particular partition keys. AWS scopes one user of a
+shared table to their own rows this way.
+
+The condition takes the `ForAllValues:` qualifier, as AWS requires for this key. Every partition key
+value the request reaches has to match. A batch or a write naming one item outside the allowed set
+is refused whole, and nothing it asked for is applied.
+
+```typescript sim-dynamodb-leading-keys
+import { CreateTableCommand, PutItemCommand } from "@aws-sdk/client-dynamodb";
+import { CreateRoleCommand, PutRolePolicyCommand } from "@aws-sdk/client-iam";
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+const accountId = simAws.defaultAccountId;
+const region = simAws.defaultRegionName;
+
+await simAws.dynamoDb().createTable(
+  new CreateTableCommand({
+    TableName: "OrdersTable",
+    KeySchema: [{ AttributeName: "customerId", KeyType: "HASH" }],
+    AttributeDefinitions: [{ AttributeName: "customerId", AttributeType: "S" }],
+    BillingMode: "PAY_PER_REQUEST",
+  }),
+);
+
+const roleCreation = await simAws.iam().createRole(
+  new CreateRoleCommand({
+    RoleName: "CustomerRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: {
+        Effect: "Allow",
+        Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+        Action: "sts:AssumeRole",
+      },
+    }),
+  }),
+);
+
+await simAws.iam().putRolePolicy(
+  new PutRolePolicyCommand({
+    RoleName: "CustomerRole",
+    PolicyName: "OwnItemsOnly",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: {
+        Effect: "Allow",
+        Action: "dynamodb:PutItem",
+        Resource: `arn:aws:dynamodb:${region}:${accountId}:table/OrdersTable`,
+        Condition: {
+          "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["c-1"] },
+        },
+      },
+    }),
+  }),
+);
+
+const caller = { kind: "arn", arn: roleCreation.Role.Arn } as const;
+
+// The customer's own item is written.
+await simAws.dynamoDb().putItem(
+  new PutItemCommand({
+    TableName: "OrdersTable",
+    Item: { customerId: { S: "c-1" }, total: { N: "25" } },
+  }),
+  { caller },
+);
+
+// Another customer's item is refused.
+try {
+  await simAws.dynamoDb().putItem(
+    new PutItemCommand({
+      TableName: "OrdersTable",
+      Item: { customerId: { S: "c-2" }, total: { N: "25" } },
+    }),
+    { caller },
+  );
+} catch (error) {
+  console.log(error instanceof Error ? error.name : "unknown error");
+  // "AccessDenied"
+}
+```
+
+Reading the partition key values needs the table's key schema. The table is found first for that,
+before the caller is authorized against it. A caller with no permission still hears `AccessDenied`
+when the table is missing, and an unauthorized caller cannot find out which table names are taken.
+
+A request carrying no readable partition key value leaves the key out of the condition context. A
+`ForAllValues:` condition matches a request carrying no value for its key, as it does on AWS. The
+condition allows such a request.
+
 A transaction is authorized as the operations it is made of rather than as itself. Each action of a
 `TransactWriteItems` needs `dynamodb:PutItem`, `dynamodb:UpdateItem`, `dynamodb:DeleteItem` or
 `dynamodb:ConditionCheckItem` against the table it names, and each `Get` of a `TransactGetItems`
@@ -3657,6 +3752,9 @@ is written.
   answering with the attributes it projects, and paging with a `LastEvaluatedKey` carrying the index
   key and the table key together. A local secondary index also answers a strongly consistent read,
   and fetches an unprojected attribute from the base table.
+- `dynamodb:LeadingKeys` on `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`,
+  `DeleteItem` and `BatchWriteItem`, carrying the partition key values the request reaches so a
+  `ForAllValues:` condition can scope a caller to particular items.
 - `DescribeTable`, answering with the full table description, by table name or ARN.
 - `ListTables`, ordered by UTF-8 bytes and paged with `Limit` and `ExclusiveStartTableName`.
 - `DeleteTable`, following the table status DynamoDB moves a deleted table through, and refusing a
@@ -3730,6 +3828,16 @@ Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `
 
 ## Limitations
 
+- `dynamodb:LeadingKeys` is the only DynamoDB condition key supplied. `dynamodb:Attributes`,
+  `dynamodb:Select` and `dynamodb:ReturnValues` are absent from the condition context, and a
+  statement conditioned on one of them matches no request. The transactional operations supply no
+  leading keys either, and are authorized by action and table alone.
+- A partition key value reaches a policy condition as a string for a `S` key and as its digits for
+  an `N` key. A binary partition key has no documented form for the condition key. A request
+  carrying one leaves the value out.
+- A request against a table that is not there is authorized carrying no leading keys, since there is
+  no key schema to read them with. A `ForAllValues:` condition matches such a request. A caller
+  barred only by that condition learns the table is missing.
 - The document client's PartiQL Commands go unconverted, because PartiQL is an operation this
   simulation lacks yet. `ExecuteStatementCommand`, `BatchExecuteStatementCommand` and
   `ExecuteTransactionCommand` are refused by name, never half converted.

package/docs/services/iam/README.md

@@ -335,6 +335,11 @@ matches instead, as AWS documents. With no value in the request there is none fo
 to equal. A `ForAnyValue:` operator answers false for an absent key whatever it wraps, because no
 request value is there to satisfy it.
 
+A `ForAllValues:` operator answers true for an absent key, which is also AWS behaviour. Every value
+the request carries matches when it carries none. AWS warns that this leaves a `ForAllValues:`
+`Allow` overly permissive, and asks for a `Null` check with a `false` value beside it. `Null` is
+absent from the operators above. A statement written that way fails closed here.
+
 ### Statements left unevaluated
 
 An operator from outside the list above fails closed. The statement holding it matches nothing, and
@@ -1684,8 +1689,9 @@ Sim IAM models the policy behaviour that multi-service tests most commonly need.
 - Only the condition operators listed above are supported. A statement using any other operator
   fails closed, matching no request. `decision.unevaluatedStatements` names those statements, and a
   test can assert that a decision was reached over policies read in full
-- A positive `ForAllValues:` condition fails to match a request carrying no value for the key, and
-  fails to match an empty value set. AWS matches both, and the negated form here matches both
+- A positive `ForAllValues:` condition fails to match an empty value set, where AWS matches one. An
+  absent context key matches, as it does on AWS. A service here leaves a key out where the request
+  carries no value for it, and the empty set is reached only by a caller passing one to `authorize`
 - Signature age is deliberately not enforced. `X-Amz-Date` must be present, well formed, and agree
   with the credential scope date, but is never compared to a clock. A client stamping real time can
   therefore reach a simulation keeping a different one. Session expiry _is_ enforced, against

package/docs/services/wafv2/README.md

@@ -173,9 +173,22 @@ resource, and `CreateWebACL` here refuses it too.
 Matching is case sensitive, as it is on AWS. A rule that means to ignore case says so with a
 `LOWERCASE` transformation and a lower case search string.
 
-WAF stops reading a body, a header set or a cookie set at 8 KB. The rule's `OversizeHandling` says
-what content past that point counts as. `MATCH` and `NO_MATCH` settle the statement without looking,
-and `CONTINUE` inspects as much as WAF would have read.
+WAF stops reading a header set or a cookie set at 8 KB. A body runs to 16 KB, the figure
+CloudFront, API Gateway and Cognito all send for inspection, and a web ACL raises it to 32, 48 or 64
+KB with `AssociationConfig`:
+
+```typescript
+AssociationConfig: {
+  RequestBody: {
+    CLOUDFRONT: { DefaultSizeInspectionLimit: "KB_64" },
+  },
+},
+```
+
+The key is the resource type the raised limit applies to, and `CLOUDFRONT`, `API_GATEWAY` and
+`COGNITO_USER_POOL` are the three a web ACL goes in front of here. The rule's `OversizeHandling`
+says what content past the limit counts as. `MATCH` and `NO_MATCH` settle the statement without
+looking, and `CONTINUE` inspects as much as WAF would have read.
 
 ## Rate limiting
 
@@ -1363,8 +1376,9 @@ fields to match. The `Captcha` and `Challenge` actions are refused, along with t
 `ChallengeConfig` and `TokenDomains` that configure them, because a browser has to answer them.
 
 Tags, logging, sampled requests and CloudWatch metrics for a web ACL are not simulated.
-`AssociationConfig`, `DataProtectionConfig`, `OnSourceDDoSProtectionConfig` and `ApplicationConfig`
-are refused for the same reason, each naming what it would have configured.
+`DataProtectionConfig`, `OnSourceDDoSProtectionConfig` and `ApplicationConfig` are refused for the
+same reason, each naming what it would have configured. An `AssociationConfig` naming a resource
+type this simulation has no association for is refused too.
 
 ## Supported operations