@kensio/yulin 1.21.14 → 1.21.16

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.d.ts

@@ -1,28 +1,33 @@
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import { type SimCfnStackInPlaceUpdates } from "./sim-cfn-stack-resource-changes.js";
+import { type SimCfnStackResourceChange } from "./sim-cfn-stack-resource-change-pairs.js";
 interface SimCfnStackUpdatePlanProperties {
     readonly current: ReadonlyMap<string, SimCfnResource>;
     readonly updated: ReadonlyMap<string, SimCfnResource>;
-}
-export interface SimCfnStackResourceReplacement {
-    readonly current: SimCfnResource;
-    readonly updated: SimCfnResource;
+    readonly inPlaceUpdates?: SimCfnStackInPlaceUpdates | undefined;
 }
 /**
  * What an update has to do to a Stack's Resources, worked out before any of it
  * happens.
  *
  * The plan compares the Resources the Stack has with the ones its new template
- * describes, and says which to delete, which to create, and what the Stack
- * holds afterwards. A Resource the template still describes unchanged is left
- * alone, keeping whatever it holds in simulated AWS.
+ * describes, and says which to update where they are, which to delete, which to
+ * create, and what the Stack holds afterwards. A Resource the template still
+ * describes unchanged is left alone, keeping whatever it holds in simulated
+ * AWS.
  *
- * It does not delete or create anything, order the work, or decide what counts
- * as a changed Resource. SimCfnStackUpdater runs the plan, and
- * simCfnStackReplacedLogicalIds decides what changed.
+ * It does not delete, create or update anything, order the work, or decide what
+ * counts as a changed Resource. SimCfnStackUpdater runs the plan, and
+ * simCfnStackResourceChanges decides what changed and how.
  */
 export declare class SimCfnStackUpdatePlan {
     /** The current and updated halves of each Resource replacement. */
-    readonly replacements: readonly SimCfnStackResourceReplacement[];
+    readonly replacements: readonly SimCfnStackResourceChange[];
+    /**
+     * The Resources to change where they are, rather than by replacing them.
+     */
+    readonly updates: readonly SimCfnStackResourceChange[];
     /**
      * The deployed Resources to delete: the ones the new template drops, and the
      * deployed halves of the ones it replaces.
@@ -36,14 +41,14 @@ export declare class SimCfnStackUpdatePlan {
     readonly updated: ReadonlyMap<string, SimCfnResource>;
     constructor(properties: SimCfnStackUpdatePlanProperties);
     /**
-     * For each logical ID the update is replacing, whether the definition taking
-     * its place says to keep the deployed Resource.
+     * What the update's deletions are to leave in simulated AWS.
      *
-     * The new half answers it because CloudFormation reads UpdateReplacePolicy
-     * off the template it is applying. An update that adds the attribute keeps
-     * the Resource it replaces, and one that drops it deletes that Resource.
+     * A replacement's new half answers for it, because CloudFormation reads
+     * UpdateReplacePolicy off the template it is applying. An update that adds
+     * the attribute keeps the Resource it replaces, and one that drops it
+     * deletes that Resource.
      */
-    replacementRetentions(): ReadonlyMap<string, boolean>;
+    retention(): SimCfnResourceRetention;
     /**
      * Whether the update changes any Resource at all.
      *
@@ -57,7 +62,9 @@ export declare class SimCfnStackUpdatePlan {
      * The map is changed in place rather than replaced, so anything already
      * holding the Stack's Resources sees the update. A Resource the template
      * leaves alone keeps the object it already had, which is what keeps its
-     * simulated AWS Resource and its creation status.
+     * simulated AWS Resource and its creation status. A Resource updated where it
+     * is takes the new record, which the update has already moved on to the
+     * deployed simulated AWS Resource.
      */
     applyTo(resources: Map<string, SimCfnResource>): void;
 }

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.js

@@ -1,20 +1,27 @@
-import { simCfnStackReplacedLogicalIds } from "./sim-cfn-stack-replaced-resources.js";
+import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import { simCfnStackResourceChanges, } from "./sim-cfn-stack-resource-changes.js";
+import { simCfnStackResourceChangePairs, } from "./sim-cfn-stack-resource-change-pairs.js";
 /**
  * What an update has to do to a Stack's Resources, worked out before any of it
  * happens.
  *
  * The plan compares the Resources the Stack has with the ones its new template
- * describes, and says which to delete, which to create, and what the Stack
- * holds afterwards. A Resource the template still describes unchanged is left
- * alone, keeping whatever it holds in simulated AWS.
+ * describes, and says which to update where they are, which to delete, which to
+ * create, and what the Stack holds afterwards. A Resource the template still
+ * describes unchanged is left alone, keeping whatever it holds in simulated
+ * AWS.
  *
- * It does not delete or create anything, order the work, or decide what counts
- * as a changed Resource. SimCfnStackUpdater runs the plan, and
- * simCfnStackReplacedLogicalIds decides what changed.
+ * It does not delete, create or update anything, order the work, or decide what
+ * counts as a changed Resource. SimCfnStackUpdater runs the plan, and
+ * simCfnStackResourceChanges decides what changed and how.
  */
 export class SimCfnStackUpdatePlan {
     /** The current and updated halves of each Resource replacement. */
     replacements;
+    /**
+     * The Resources to change where they are, rather than by replacing them.
+     */
+    updates;
     /**
      * The deployed Resources to delete: the ones the new template drops, and the
      * deployed halves of the ones it replaces.
@@ -27,20 +34,15 @@ export class SimCfnStackUpdatePlan {
     creations;
     updated;
     constructor(properties) {
-        const { current, updated } = properties;
-        const replaced = simCfnStackReplacedLogicalIds({ current, updated });
+        const { current, updated, inPlaceUpdates } = properties;
+        const { replaced, updatedInPlace } = simCfnStackResourceChanges({
+            current,
+            updated,
+            inPlaceUpdates,
+        });
         this.updated = updated;
-        this.replacements = replaced
-            .values()
-            .map((logicalId) => {
-            const currentResource = current.get(logicalId);
-            const updatedResource = updated.get(logicalId);
-            if (currentResource === undefined || updatedResource === undefined) {
-                throw new Error(`CloudFormation replacement ${logicalId} is missing one of its Resource definitions`);
-            }
-            return { current: currentResource, updated: updatedResource };
-        })
-            .toArray();
+        this.replacements = simCfnStackResourceChangePairs(current, updated, replaced);
+        this.updates = simCfnStackResourceChangePairs(current, updated, updatedInPlace);
         // Both lists are worked out now rather than on demand, because the Stack's
         // Resource map is the current one and applying the plan changes it.
         this.deletions = current
@@ -57,18 +59,20 @@ export class SimCfnStackUpdatePlan {
             .toArray();
     }
     /**
-     * For each logical ID the update is replacing, whether the definition taking
-     * its place says to keep the deployed Resource.
+     * What the update's deletions are to leave in simulated AWS.
      *
-     * The new half answers it because CloudFormation reads UpdateReplacePolicy
-     * off the template it is applying. An update that adds the attribute keeps
-     * the Resource it replaces, and one that drops it deletes that Resource.
+     * A replacement's new half answers for it, because CloudFormation reads
+     * UpdateReplacePolicy off the template it is applying. An update that adds
+     * the attribute keeps the Resource it replaces, and one that drops it
+     * deletes that Resource.
      */
-    replacementRetentions() {
-        return new Map(this.replacements.map(({ current, updated }) => [
-            current.logicalId,
-            updated.retainedOnReplace,
-        ]));
+    retention() {
+        return new SimCfnResourceRetention({
+            replaced: new Map(this.replacements.map(({ current, updated }) => [
+                current.logicalId,
+                updated.retainedOnReplace,
+            ])),
+        });
     }
     /**
      * Whether the update changes any Resource at all.
@@ -77,7 +81,9 @@ export class SimCfnStackUpdatePlan {
      * updates the Stack, so this is not the whole no-op question.
      */
     get changesResources() {
-        return this.deletions.length > 0 || this.creations.length > 0;
+        return (this.deletions.length > 0 ||
+            this.creations.length > 0 ||
+            this.updates.length > 0);
     }
     /**
      * Move the Stack's Resource map on to the new template.
@@ -85,7 +91,9 @@ export class SimCfnStackUpdatePlan {
      * The map is changed in place rather than replaced, so anything already
      * holding the Stack's Resources sees the update. A Resource the template
      * leaves alone keeps the object it already had, which is what keeps its
-     * simulated AWS Resource and its creation status.
+     * simulated AWS Resource and its creation status. A Resource updated where it
+     * is takes the new record, which the update has already moved on to the
+     * deployed simulated AWS Resource.
      */
     applyTo(resources) {
         const dropped = resources
@@ -98,5 +106,8 @@ export class SimCfnStackUpdatePlan {
         for (const resource of this.creations) {
             resources.set(resource.logicalId, resource);
         }
+        for (const { updated } of this.updates) {
+            resources.set(updated.logicalId, updated);
+        }
     }
 }

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.d.ts

@@ -22,11 +22,13 @@ interface SimCfnStackUpdaterProperties {
 /**
  * Applies a changed template to a Stack that is already deployed.
  *
- * The Resources the new template drops or replaces go first, in the reverse of
- * the order they were created in, and the ones it adds or replaces are created
- * after, in dependency order. Everything else is left where it is, which is the
- * point of updating a Stack rather than replacing it: what a Bucket holds and
- * what a Table has in it survive a change elsewhere in the template.
+ * The Resources a service can change where they are go first, while everything
+ * the Stack had is still deployed. Then the Resources the new template drops or
+ * replaces, in the reverse of the order they were created in, and last the ones
+ * it adds or replaces, in dependency order. Everything else is left where it
+ * is, which is the point of updating a Stack rather than replacing it: what a
+ * Bucket holds and what a Table has in it survive a change elsewhere in the
+ * template.
  *
  * It does not own Stack status or the Stack's visible template.
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.js

@@ -2,7 +2,6 @@ import { SimCloudFormationValidationError } from "../../error/sim-cloudformation
 import { makeSimCfnStackResourceMap } from "../resource-map/sim-cfn-stack-resource-map.js";
 import { SimCfnStackUpdatePlan } from "./sim-cfn-stack-update-plan.js";
 import { simCfnStackTemplateChanged } from "./sim-cfn-stack-template-changes.js";
-import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
 /**
  * What CloudFormation answers an update that would change nothing.
  *
@@ -14,11 +13,13 @@ export const simCfnNoUpdatesMessage = "No updates are to be performed.";
 /**
  * Applies a changed template to a Stack that is already deployed.
  *
- * The Resources the new template drops or replaces go first, in the reverse of
- * the order they were created in, and the ones it adds or replaces are created
- * after, in dependency order. Everything else is left where it is, which is the
- * point of updating a Stack rather than replacing it: what a Bucket holds and
- * what a Table has in it survive a change elsewhere in the template.
+ * The Resources a service can change where they are go first, while everything
+ * the Stack had is still deployed. Then the Resources the new template drops or
+ * replaces, in the reverse of the order they were created in, and last the ones
+ * it adds or replaces, in dependency order. Everything else is left where it
+ * is, which is the point of updating a Stack rather than replacing it: what a
+ * Bucket holds and what a Table has in it survive a change elsewhere in the
+ * template.
  *
  * It does not own Stack status or the Stack's visible template.
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.
@@ -36,6 +37,7 @@ export class SimCfnStackUpdater {
                 background,
                 template: updated,
             }),
+            inPlaceUpdates: properties.operations,
         });
     }
     /**
@@ -59,7 +61,10 @@ export class SimCfnStackUpdater {
         const { resources, operations } = this.properties;
         const { plan } = this;
         await operations.assertUpdatesAllowed(resources, plan.updated, plan.replacements);
-        await operations.delete(resources, plan.deletions, new SimCfnResourceRetention({ replaced: plan.replacementRetentions() }));
+        // Before anything comes down. An update that fails here has changed some
+        // of the Stack's Resources and deleted none of them.
+        await operations.updateInPlace(resources, plan.updates);
+        await operations.delete(resources, plan.deletions, plan.retention());
         plan.applyTo(resources);
         // Once the Stack has stopped holding them, and before the replacements are
         // created. An update that keeps a Resource and then fails to create the one

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-change.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Whether the change between two definitions of a secret replaces it.
+ *
+ * `Name` is the only property real CloudFormation replaces a secret for. It is
+ * read as the template writes it, before intrinsic resolution, which is all the
+ * update plan has to go on. Two different expressions resolving to the same
+ * name replace the secret, which is the safe way round to be wrong.
+ */
+export declare function simCfnSecretsManagerSecretReplaced(current: SimCfnResource, updated: SimCfnResource): boolean;
+/**
+ * Whether the new template asks the secret to hold a different value.
+ *
+ * A secret takes its value from `SecretString` or `GenerateSecretString`, so a
+ * change to either is a new version. A change to anything else leaves the
+ * versions alone, which is what keeps a generated password across an update.
+ */
+export declare function simCfnSecretsManagerSecretValueChanged(currentProperties: SimCfnTemplateValueRecord, updatedProperties: SimCfnTemplateValueRecord): boolean;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-change.js

@@ -0,0 +1,39 @@
+import { simCfnTemplateSignature } from "../../../cloudformation/stack/update/sim-cfn-template-signature.js";
+/**
+ * Whether the change between two definitions of a secret replaces it.
+ *
+ * `Name` is the only property real CloudFormation replaces a secret for. It is
+ * read as the template writes it, before intrinsic resolution, which is all the
+ * update plan has to go on. Two different expressions resolving to the same
+ * name replace the secret, which is the safe way round to be wrong.
+ */
+export function simCfnSecretsManagerSecretReplaced(current, updated) {
+    return nameSignature(current) !== nameSignature(updated);
+}
+/**
+ * Whether the new template asks the secret to hold a different value.
+ *
+ * A secret takes its value from `SecretString` or `GenerateSecretString`, so a
+ * change to either is a new version. A change to anything else leaves the
+ * versions alone, which is what keeps a generated password across an update.
+ */
+export function simCfnSecretsManagerSecretValueChanged(currentProperties, updatedProperties) {
+    return (valueSignature(currentProperties) !== valueSignature(updatedProperties));
+}
+/**
+ * A stable string for the two properties a secret's value comes from.
+ *
+ * A property the template leaves out signs as null, which no declared value can
+ * collide with. `SecretString` is a string and `GenerateSecretString` is an
+ * object.
+ */
+function valueSignature(properties) {
+    return simCfnTemplateSignature([
+        properties["SecretString"] ?? null,
+        properties["GenerateSecretString"] ?? null,
+    ]);
+}
+function nameSignature(resource) {
+    const name = resource.properties["Name"];
+    return name === undefined ? "" : simCfnTemplateSignature(name);
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-deleter.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+interface SimCfnSecretsManagerSecretDeleterProperties {
+    readonly secretsManager: SimSecretsManager;
+}
+/**
+ * Removes the secret an AWS::SecretsManager::Secret Resource deployed.
+ *
+ * DeleteSecret schedules the deletion rather than carrying it out, so a torn
+ * down Stack leaves a secret waiting out its recovery window. That is what
+ * CloudFormation does, and the point of the window is that the secret is
+ * recoverable afterwards.
+ */
+export declare class SimCfnSecretsManagerSecretDeleter {
+    private readonly secretsManager;
+    constructor(properties: SimCfnSecretsManagerSecretDeleterProperties);
+    /**
+     * Schedule the deployed secret's deletion.
+     */
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
+}
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-deleter.js

@@ -0,0 +1,23 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Removes the secret an AWS::SecretsManager::Secret Resource deployed.
+ *
+ * DeleteSecret schedules the deletion rather than carrying it out, so a torn
+ * down Stack leaves a secret waiting out its recovery window. That is what
+ * CloudFormation does, and the point of the window is that the secret is
+ * recoverable afterwards.
+ */
+export class SimCfnSecretsManagerSecretDeleter {
+    secretsManager;
+    constructor(properties) {
+        this.secretsManager = properties.secretsManager;
+    }
+    /**
+     * Schedule the deployed secret's deletion.
+     */
+    async delete(resource, options) {
+        const secret = resource.simResource;
+        assertDefined(secret, `sim Secrets Manager secret for CloudFormation Resource ${resource.logicalId}`);
+        await this.secretsManager.deleteSecret({ input: { SecretId: secret.arn.value } }, options);
+    }
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-template.test-support.d.ts

@@ -0,0 +1,21 @@
+import type { CfnTemplateBodyRecord } from "../../../cloudformation/template/sim-cfn-template.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SecretTemplateProperties {
+    readonly name?: string;
+    readonly description?: string;
+    readonly kmsKeyId?: string;
+    readonly tags?: readonly SimCfnTemplateValueRecord[];
+    readonly secretString?: string;
+    readonly passwordLength?: number;
+    /** A second Resource reading the secret through a dynamic reference. */
+    readonly reader?: boolean;
+}
+/**
+ * A template holding one secret, and optionally a parameter reading it.
+ *
+ * The parameter stands in for anything taking a copy of the value when the
+ * Stack deploys, such as a CloudFront origin custom header. It reads the secret
+ * through the `Fn::Join` shape CDK emits for a secret in the same Stack.
+ */
+export declare function secretTemplate(properties?: SecretTemplateProperties): CfnTemplateBodyRecord;
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-template.test-support.js

@@ -0,0 +1,64 @@
+/**
+ * A template holding one secret, and optionally a parameter reading it.
+ *
+ * The parameter stands in for anything taking a copy of the value when the
+ * Stack deploys, such as a CloudFront origin custom header. It reads the secret
+ * through the `Fn::Join` shape CDK emits for a secret in the same Stack.
+ */
+export function secretTemplate(properties = {}) {
+    const secret = {
+        Type: "AWS::SecretsManager::Secret",
+        Properties: secretProperties(properties),
+    };
+    return {
+        Resources: properties.reader === true
+            ? { EdgeCredential: secret, Reader: readerResource() }
+            : { EdgeCredential: secret },
+    };
+}
+function secretProperties(properties) {
+    const { name, description, kmsKeyId, tags, secretString } = properties;
+    const declared = {};
+    if (name !== undefined) {
+        declared["Name"] = name;
+    }
+    if (description !== undefined) {
+        declared["Description"] = description;
+    }
+    if (kmsKeyId !== undefined) {
+        declared["KmsKeyId"] = kmsKeyId;
+    }
+    if (tags !== undefined) {
+        declared["Tags"] = [...tags];
+    }
+    if (secretString === undefined) {
+        declared["GenerateSecretString"] = {
+            SecretStringTemplate: "{}",
+            GenerateStringKey: "current",
+            PasswordLength: properties.passwordLength ?? 64,
+        };
+    }
+    else {
+        declared["SecretString"] = secretString;
+    }
+    return declared;
+}
+function readerResource() {
+    return {
+        Type: "AWS::SSM::Parameter",
+        Properties: {
+            Name: "edge-credential-copy",
+            Type: "String",
+            Value: {
+                "Fn::Join": [
+                    "",
+                    [
+                        "{{resolve:secretsmanager:",
+                        { Ref: "EdgeCredential" },
+                        ":SecretString:current::}}",
+                    ],
+                ],
+            },
+        },
+    };
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-update.test-support.d.ts

@@ -0,0 +1,18 @@
+import { SimAws } from "../../../aws/sim-aws.js";
+import type { CfnTemplateBodyRecord } from "../../../cloudformation/template/sim-cfn-template.js";
+/**
+ * A simulated AWS in one account and region, for a secret update test.
+ */
+export declare function secretUpdateSimAws(): SimAws;
+/**
+ * Deploy a template and wait for its Resources.
+ */
+export declare function deploySecretStack(simAws: SimAws, stackName: string, template: CfnTemplateBodyRecord): Promise<void>;
+/**
+ * Apply a template to a deployed stack and wait for the update.
+ */
+export declare function updateSecretStack(simAws: SimAws, stackName: string, template: CfnTemplateBodyRecord): Promise<void>;
+/**
+ * The ARN of the secret a deployed stack holds.
+ */
+export declare function deployedSecretArn(simAws: SimAws, stackName: string): string;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-update.test-support.js

@@ -0,0 +1,39 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimAws } from "../../../aws/sim-aws.js";
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+/**
+ * A simulated AWS in one account and region, for a secret update test.
+ */
+export function secretUpdateSimAws() {
+    return new SimAws({
+        defaultAccountId: "111111111111",
+        defaultRegionName: "eu-west-2",
+    });
+}
+/**
+ * Deploy a template and wait for its Resources.
+ */
+export async function deploySecretStack(simAws, stackName, template) {
+    const stack = await simAws
+        .cloudFormation()
+        .deployTemplate({ stackName, template });
+    await stack.waitForDeployComplete();
+}
+/**
+ * Apply a template to a deployed stack and wait for the update.
+ */
+export async function updateSecretStack(simAws, stackName, template) {
+    await simAws.cloudFormation().updateStack({
+        input: { StackName: stackName, TemplateBody: jsonStringify(template) },
+    });
+    await simAws.cloudFormation().waitForStackUpdateComplete(stackName);
+}
+/**
+ * The ARN of the secret a deployed stack holds.
+ */
+export function deployedSecretArn(simAws, stackName) {
+    const stack = simAws.cloudFormation().getStackByName(stackName);
+    const secret = stack?.getResource("EdgeCredential")?.simResource;
+    assertDefined(secret, `deployed EdgeCredential secret in Stack ${stackName}`);
+    return secret.arn.value;
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-updater.d.ts

@@ -0,0 +1,37 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCloudFormationResourceInPlaceUpdateContext } from "../../../cloudformation/resource/sim-cfn-resource.type.js";
+import type { SimSecretsManagerSecret } from "../../secret/sim-secrets-manager-secret.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+interface SimCfnSecretsManagerSecretUpdaterProperties {
+    readonly secretsManager: SimSecretsManager;
+}
+/**
+ * Applies a changed AWS::SecretsManager::Secret Resource to the deployed
+ * secret.
+ *
+ * Every property but `Name` is applied with no interruption, as real
+ * CloudFormation applies it. That matters most for the value. A secret keeps
+ * its versions across a description or a tag change, and the things holding a
+ * copy of the value stay in step with it.
+ *
+ * Replacing instead would also fail. DeleteSecret schedules the deletion and
+ * leaves the name held for the recovery window. The secret taking its place
+ * would then ask for a name the deleted one still has.
+ */
+export declare class SimCfnSecretsManagerSecretUpdater {
+    private readonly secretsManager;
+    constructor(properties: SimCfnSecretsManagerSecretUpdaterProperties);
+    /**
+     * Apply the new Resource definition to the deployed secret.
+     */
+    update(current: SimCfnResource, updated: SimCfnResource, context: SimCloudFormationResourceInPlaceUpdateContext): Promise<SimSecretsManagerSecret>;
+    /**
+     * The value to write, where the new template asks for a different one.
+     *
+     * Nothing is written for an unchanged value. Regenerating a password for a
+     * description change would leave every copy of it taken at deployment
+     * holding the old one.
+     */
+    private changedValue;
+}
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-updater.js

@@ -0,0 +1,66 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { simCfnSecretsManagerSecretValueChanged } from "./sim-cfn-secrets-manager-secret-change.js";
+import { SimCfnSecretsManagerSecretProperties } from "./sim-cfn-secrets-manager-secret-properties.js";
+/**
+ * Applies a changed AWS::SecretsManager::Secret Resource to the deployed
+ * secret.
+ *
+ * Every property but `Name` is applied with no interruption, as real
+ * CloudFormation applies it. That matters most for the value. A secret keeps
+ * its versions across a description or a tag change, and the things holding a
+ * copy of the value stay in step with it.
+ *
+ * Replacing instead would also fail. DeleteSecret schedules the deletion and
+ * leaves the name held for the recovery window. The secret taking its place
+ * would then ask for a name the deleted one still has.
+ */
+export class SimCfnSecretsManagerSecretUpdater {
+    secretsManager;
+    constructor(properties) {
+        this.secretsManager = properties.secretsManager;
+    }
+    /**
+     * Apply the new Resource definition to the deployed secret.
+     */
+    async update(current, updated, context) {
+        const secret = current.simResource;
+        assertDefined(secret, `sim Secrets Manager secret for CloudFormation Resource ${current.logicalId}`);
+        const properties = new SimCfnSecretsManagerSecretProperties({
+            resource: updated,
+            properties: context.updatedResolvedProperties,
+        });
+        const kmsKeyId = properties.kmsKeyId();
+        await this.secretsManager.updateSecret({
+            input: {
+                SecretId: secret.arn.value,
+                // CloudFormation applies the template as the desired state, so a
+                // Description the new template leaves out is cleared rather than
+                // left as it was. An empty one is how UpdateSecret clears it.
+                Description: properties.description() ?? "",
+                KmsKeyId: kmsKeyId,
+                SecretString: this.changedValue(properties, context),
+            },
+        }, simCfnResourceCallerOptions(context.caller));
+        // The parts UpdateSecret has no way to ask for. Real Secrets Manager
+        // changes tags with TagResource and UntagResource, which are not
+        // simulated, and UpdateSecret cannot put a secret back on the
+        // aws/secretsmanager key.
+        if (kmsKeyId === undefined) {
+            secret.kmsKeyId = undefined;
+        }
+        secret.tags = properties.tags() ?? [];
+        return secret;
+    }
+    /**
+     * The value to write, where the new template asks for a different one.
+     *
+     * Nothing is written for an unchanged value. Regenerating a password for a
+     * description change would leave every copy of it taken at deployment
+     * holding the old one.
+     */
+    changedValue(properties, context) {
+        const changed = simCfnSecretsManagerSecretValueChanged(context.currentResolvedProperties, context.updatedResolvedProperties);
+        return changed ? properties.secretString() : undefined;
+    }
+}