@kensio/yulin 1.21.17 → 1.21.18

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-arn.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+import { type SimLambdaFunctionArn } from "../../../lambda/function/sim-lambda-function-configuration.js";
+/**
+ * The provider function a custom Resource's `ServiceToken` names, as an ARN.
+ *
+ * Nothing comes back where the Resource names no provider this Stack can put
+ * an ARN to. A `ServiceToken` built from a Parameter, or one pointing at a
+ * Resource type that is not a function, both leave the deployment with nothing
+ * to authorize against, and inventing an ARN for it would refuse a template
+ * over a permission real CloudFormation never asked for.
+ */
+export declare function simCdkProviderInvokeArn(resolvedProperties: SimCfnTemplateValueRecord, resources: ReadonlyMap<string, SimCfnResource>): SimLambdaFunctionArn | undefined;

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-arn.js

@@ -0,0 +1,63 @@
+import { namesSimCfnUnansweredAttribute } from "../../resource/cfn/sim-cfn-unanswered-attribute.js";
+import { parseSimLambdaFunctionArn } from "../../../lambda/function/sim-lambda-function-arn-parts.js";
+import { simLambdaFunctionArn, } from "../../../lambda/function/sim-lambda-function-configuration.js";
+const lambdaFunctionResourceType = "AWS::Lambda::Function";
+/**
+ * The provider function a custom Resource's `ServiceToken` names, as an ARN.
+ *
+ * Nothing comes back where the Resource names no provider this Stack can put
+ * an ARN to. A `ServiceToken` built from a Parameter, or one pointing at a
+ * Resource type that is not a function, both leave the deployment with nothing
+ * to authorize against, and inventing an ARN for it would refuse a template
+ * over a permission real CloudFormation never asked for.
+ */
+export function simCdkProviderInvokeArn(resolvedProperties, resources) {
+    const serviceToken = resolvedProperties["ServiceToken"];
+    if (typeof serviceToken !== "string" || serviceToken === "") {
+        return undefined;
+    }
+    return (writtenFunctionArn(serviceToken) ??
+        standInFunctionArn(serviceToken, resources));
+}
+/**
+ * The ARN a `ServiceToken` already carries.
+ *
+ * A provider deployed outside this Stack is named by its ARN outright, and a
+ * template written by hand can name one in the same Stack that way too.
+ */
+function writtenFunctionArn(serviceToken) {
+    return parseSimLambdaFunctionArn(serviceToken) === undefined
+        ? undefined
+        : serviceToken;
+}
+/**
+ * The ARN behind a `ServiceToken` that resolved to an attribute stand-in.
+ *
+ * CDK writes `ServiceToken` as an `Fn::GetAtt` for the provider function's
+ * `Arn`, and this simulator leaves that provider uncreated: the function is
+ * declined on its Python runtime and then reported as scaffolding for the
+ * custom Resource the simulator carries out itself. An uncreated Resource
+ * answers `Fn::GetAtt` with {@link namesSimCfnUnansweredAttribute}'s stand-in
+ * rather than an ARN.
+ *
+ * The name survives that refusal. Sim Lambda works out the name real
+ * CloudFormation would have given the function before declining it, so the
+ * Resource's `Ref` holds a function name to build the ARN from. A provider
+ * that reached neither creation nor a name has only its logical ID behind
+ * `Ref`, and an ARN built from that would be denied by a policy naming the
+ * function real CloudFormation invokes.
+ */
+function standInFunctionArn(serviceToken, resources) {
+    if (!namesSimCfnUnansweredAttribute(serviceToken, resources.keys())) {
+        return undefined;
+    }
+    const provider = resources.get(serviceToken.split(".", 1)[0] ?? "");
+    if (provider?.type !== lambdaFunctionResourceType ||
+        (!provider.deployed && provider.uncreatedPhysicalName === undefined)) {
+        return undefined;
+    }
+    const { refValue } = provider;
+    return typeof refValue === "string" && refValue !== ""
+        ? simLambdaFunctionArn(provider.accountRegionScope, refValue)
+        : undefined;
+}

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-auth-z.d.ts

@@ -0,0 +1,36 @@
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCloudFormationParsedResourceType } from "../../resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * What authorizing one custom Resource's provider invoke needs.
+ */
+export interface SimCdkProviderInvokeAuthZProperties {
+    readonly resourceType: SimCloudFormationParsedResourceType;
+    readonly resource: SimCfnResource;
+    readonly resolvedProperties: SimCfnTemplateValueRecord;
+    readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly simAws: SimAws;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Authorize the invoke a custom Resource costs the deployment.
+ *
+ * Real CloudFormation answers a `Custom::` Resource by invoking the function
+ * its `ServiceToken` names, as the Stack's execution role. That invoke is the
+ * first thing a deployment pays for, and a role without `lambda:InvokeFunction`
+ * on the provider fails the Stack there rather than at the work the provider
+ * would have done.
+ *
+ * This simulator carries several custom Resources out itself instead of
+ * running the provider, which leaves the invoke unpaid for unless it is
+ * authorized here. A deploy Role standing in for a real CloudFormation
+ * execution policy is meant to fail the same template the real one refuses.
+ *
+ * Only the caller's identity policies decide it. The provider function is
+ * uncreated in the usual case, so there is no simulated function holding a
+ * resource policy to consult, and CDK grants the invoke on the execution role
+ * anyway.
+ */
+export declare function authorizeSimCdkProviderInvoke(properties: SimCdkProviderInvokeAuthZProperties): void;

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-auth-z.js

@@ -0,0 +1,47 @@
+import { simScopeIamAuthZ } from "../../../iam/authorize/sim-iam-region-auth-z.js";
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simCdkProviderInvokeArn } from "./sim-cdk-provider-invoke-arn.js";
+const customResourceProviderName = "Custom";
+const invokeAction = "lambda:InvokeFunction";
+/**
+ * Authorize the invoke a custom Resource costs the deployment.
+ *
+ * Real CloudFormation answers a `Custom::` Resource by invoking the function
+ * its `ServiceToken` names, as the Stack's execution role. That invoke is the
+ * first thing a deployment pays for, and a role without `lambda:InvokeFunction`
+ * on the provider fails the Stack there rather than at the work the provider
+ * would have done.
+ *
+ * This simulator carries several custom Resources out itself instead of
+ * running the provider, which leaves the invoke unpaid for unless it is
+ * authorized here. A deploy Role standing in for a real CloudFormation
+ * execution policy is meant to fail the same template the real one refuses.
+ *
+ * Only the caller's identity policies decide it. The provider function is
+ * uncreated in the usual case, so there is no simulated function holding a
+ * resource policy to consult, and CDK grants the invoke on the execution role
+ * anyway.
+ */
+export function authorizeSimCdkProviderInvoke(properties) {
+    if (properties.resourceType.providerName !== customResourceProviderName) {
+        return;
+    }
+    const functionArn = simCdkProviderInvokeArn(properties.resolvedProperties, properties.resources);
+    if (functionArn === undefined) {
+        return;
+    }
+    const { accountId, regionName } = properties.resource.accountRegionScope;
+    const decision = simScopeIamAuthZ(properties.simAws.accountRegionScope(accountId, regionName)).authorize({
+        action: invokeAction,
+        resource: functionArn,
+        caller: properties.caller,
+    });
+    if (decision.isDenied) {
+        throw new SimIamAccessDenied({
+            principal: decision.caller.principal,
+            reason: decision.denialReason,
+            action: invokeAction,
+            resource: functionArn,
+        });
+    }
+}

package/dist/service/cloudformation/cdk/s3/bucket-notifications/property/sim-cdk-bucket-notification-properties.js

@@ -2,9 +2,11 @@ import { bucketNotificationsError } from "../error/sim-cdk-bucket-notification-e
 /**
  * The properties CDK puts on a Custom::S3BucketNotifications Resource.
  *
- * `ServiceToken` is read and ignored. It points at CDK's own Python provider
- * function, whose whole job is the PutBucketNotificationConfiguration call this
- * factory makes instead.
+ * `ServiceToken` is accepted and read no further here. It points at CDK's own
+ * Python provider function, whose whole job is the
+ * PutBucketNotificationConfiguration call this factory makes instead. The
+ * deployment reads it once more, to authorize the invoke real CloudFormation
+ * makes of that function.
  */
 const knownPropertyNames = new Set([
     "BucketName",

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications-remover.js

@@ -1,5 +1,6 @@
 import { bucketNotificationsError } from "./error/sim-cdk-bucket-notification-error.js";
 import { SimCdkBucketNotificationProperties } from "./property/sim-cdk-bucket-notification-properties.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Removes the notification configuration a Custom::S3BucketNotifications
  * Resource put on a Bucket.
@@ -29,6 +30,6 @@ export class SimCdkBucketNotificationsRemover {
                 Bucket: properties.bucketName,
                 NotificationConfiguration: {},
             },
-        });
+        }, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications.d.ts

@@ -16,10 +16,13 @@ import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFo
  * bucket alongside the function's `AWS::Lambda::Permission` is the circular
  * dependency this Resource type exists to break.
  *
- * `ServiceToken` is read for the provider function it names, and otherwise
- * ignored. That function is declined on its runtime, as CDK's BucketDeployment
- * provider is, and recorded as inert rather than as a gap, since this factory
- * has already made the call it would have made.
+ * `ServiceToken` is read for the provider function it names. That function is
+ * declined on its runtime, as CDK's BucketDeployment provider is, and recorded
+ * as inert rather than as a gap, since this factory has already made the call
+ * it would have made. The deployment still pays for the invoke real
+ * CloudFormation makes, which
+ * {@link import("../../provider/sim-cdk-provider-invoke-auth-z.js").authorizeSimCdkProviderInvoke}
+ * authorizes for every custom Resource ahead of its factory.
  */
 export declare class SimCdkBucketNotificationsResourceFactory implements SimCfnServiceResourceFactory {
     /**

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications.js

@@ -2,6 +2,7 @@ import { SimCdkBucketNotificationConfiguration } from "./configuration/sim-cdk-b
 import { bucketNotificationsError } from "./error/sim-cdk-bucket-notification-error.js";
 import { SimCdkBucketNotificationProperties } from "./property/sim-cdk-bucket-notification-properties.js";
 import { SimCdkBucketNotificationsRemover } from "./sim-cdk-bucket-notifications-remover.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for CDK Bucket event notifications.
  *
@@ -18,10 +19,13 @@ import { SimCdkBucketNotificationsRemover } from "./sim-cdk-bucket-notifications
  * bucket alongside the function's `AWS::Lambda::Permission` is the circular
  * dependency this Resource type exists to break.
  *
- * `ServiceToken` is read for the provider function it names, and otherwise
- * ignored. That function is declined on its runtime, as CDK's BucketDeployment
- * provider is, and recorded as inert rather than as a gap, since this factory
- * has already made the call it would have made.
+ * `ServiceToken` is read for the provider function it names. That function is
+ * declined on its runtime, as CDK's BucketDeployment provider is, and recorded
+ * as inert rather than as a gap, since this factory has already made the call
+ * it would have made. The deployment still pays for the invoke real
+ * CloudFormation makes, which
+ * {@link import("../../provider/sim-cdk-provider-invoke-auth-z.js").authorizeSimCdkProviderInvoke}
+ * authorizes for every custom Resource ahead of its factory.
  */
 export class SimCdkBucketNotificationsResourceFactory {
     /**
@@ -48,7 +52,7 @@ export class SimCdkBucketNotificationsResourceFactory {
                 NotificationConfiguration: configuration,
                 SkipDestinationValidation: properties.skipDestinationValidation,
             },
-        });
+        }, simCfnResourceCallerOptions(context.caller));
         return undefined;
     }
     /**

package/dist/service/cloudformation/cdk/ssm/cross-region-parameter/sim-cdk-cross-region-parameter-properties.js

@@ -5,9 +5,10 @@ import { crossRegionParameterError } from "./sim-cdk-cross-region-parameter-erro
  * The properties CDK puts on a Custom::CrossRegionStringParameterReader
  * Resource.
  *
- * `ServiceToken` is read and ignored. It points at CDK's own provider
- * function, whose whole job is the GetParameter call this factory makes
- * instead. `RefreshToken` is the logical ID of the function version the
+ * `ServiceToken` is accepted and read no further here. It points at CDK's own
+ * provider function, whose whole job is the GetParameter call this factory
+ * makes instead, and the deployment reads it once more to authorize the invoke
+ * real CloudFormation makes of that function. `RefreshToken` is the logical ID of the function version the
  * parameter was written from, and CDK puts it there so that publishing a new
  * version makes CloudFormation run the reader again. The reader here runs on
  * every deployment either way, so the token has nothing left to say.

package/dist/service/cloudformation/cdk/ssm/cross-region-parameter/sim-cdk-cross-region-parameter-reader.js

@@ -2,6 +2,7 @@ import { SimSsmParameterNotFound } from "../../../../ssm/error/sim-ssm.error.js"
 import { crossRegionParameterError, crossRegionParameterResourceTypeName, } from "./sim-cdk-cross-region-parameter-error.js";
 import { SimCdkCrossRegionParameterProperties } from "./sim-cdk-cross-region-parameter-properties.js";
 import { SimCdkCrossRegionParameterReading } from "./sim-cdk-cross-region-parameter-reading.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for CDK's cross-Region parameter reader.
  *
@@ -64,7 +65,7 @@ export class SimCdkCrossRegionParameterReaderResourceFactory {
             const output = await context.simAws
                 .accountRegionScope(resource.accountRegionScope.accountId, regionName)
                 .ssm()
-                .getParameter({ input: { Name: parameterName } });
+                .getParameter({ input: { Name: parameterName } }, simCfnResourceCallerOptions(context.caller));
             return output.Parameter?.Value;
         }
         catch (error) {

package/dist/service/cloudformation/resource/create/sim-cfn-resource-creator.js

@@ -1,6 +1,7 @@
 import { parseSimCloudFormationResourceType } from "../parser/sim-cfn-resource-parser.js";
 import { resolveSimCloudFormationServiceResourceFactory } from "../resolve/service/sim-cfn-service-resolver.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { authorizeSimCdkProviderInvoke } from "../../cdk/provider/sim-cdk-provider-invoke-auth-z.js";
 /**
  * Creates the underlying simulated AWS service Resource for a CloudFormation
  * Resource.
@@ -35,9 +36,18 @@ export class SimCfnResourceCreator {
         const resourceType = parseSimCloudFormationResourceType(type);
         const factory = this.cfnResourceFactory ??
             resolveSimCloudFormationServiceResourceFactory(context.simAws, this.resource.accountRegionScope, resourceType);
+        const resolvedProperties = await this.resource.resolvedProperties(context);
+        authorizeSimCdkProviderInvoke({
+            resourceType,
+            resource: this.resource,
+            resolvedProperties,
+            resources: context.resources,
+            simAws: context.simAws,
+            caller: context.caller,
+        });
         const resolvedContext = {
             ...context,
-            resolvedProperties: await this.resource.resolvedProperties(context),
+            resolvedProperties,
         };
         return await factory.create(resourceType.resourceTypeName, this.resource, resolvedContext);
     }

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-deleter.js

@@ -1,6 +1,7 @@
 import { parseSimCloudFormationResourceType } from "../parser/sim-cfn-resource-parser.js";
 import { resolveSimCloudFormationServiceResourceFactory } from "../resolve/service/sim-cfn-service-resolver.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { authorizeSimCdkProviderInvoke } from "../../cdk/provider/sim-cdk-provider-invoke-auth-z.js";
 /**
  * Removes the underlying simulated AWS service Resource for a CloudFormation
  * Resource.
@@ -39,9 +40,18 @@ export class SimCfnResourceDeleter {
         const resourceType = parseSimCloudFormationResourceType(type);
         const factory = this.cfnResourceFactory ??
             resolveSimCloudFormationServiceResourceFactory(context.simAws, this.resource.accountRegionScope, resourceType);
+        const resolvedProperties = await this.resource.resolvedProperties(context);
+        authorizeSimCdkProviderInvoke({
+            resourceType,
+            resource: this.resource,
+            resolvedProperties,
+            resources: context.resources,
+            simAws: context.simAws,
+            caller: context.caller,
+        });
         await factory.delete(resourceType.resourceTypeName, this.resource, {
             ...context,
-            resolvedProperties: await this.resource.resolvedProperties(context),
+            resolvedProperties,
         });
     }
 }

package/docs/services/cloudformation/README.md

@@ -2549,6 +2549,94 @@ working simulation with a hand-written one.
 The provider is found through the `ServiceToken` its custom resource names it by, not by the logical
 ID CDK generated for it. That ID is a hash of the construct path, and no kind of thing to match on.
 
+### What a custom resource costs the deploy Role
+
+Real CloudFormation answers a `Custom::` resource by invoking the provider function its `ServiceToken`
+names, as the stack's execution role. Yulin carries several of these out itself instead of running the
+provider, and it authorizes that invoke anyway. A deploy Role holding no `lambda:InvokeFunction` on the
+provider fails the stack where the real deployment fails.
+
+The `ServiceToken` decides the ARN. A token written as an ARN is taken as it stands. CDK's `Fn::GetAtt`
+for the provider's `Arn` is resolved back to the function the stack declares, since the provider is
+left uncreated and has no ARN of its own to give.
+
+The work the resource does is authorized too, as the deployment's principal.
+`Custom::S3BucketNotifications` costs `s3:PutBucketNotification` and
+`Custom::CrossRegionStringParameterReader` costs `ssm:GetParameter`. `Custom::CDKBucketDeployment`
+writes its Objects into the simulated Bucket without sending `PutObject`, so nothing there reaches IAM.
+
+```typescript sim-cloudformation-custom-resource-invoke
+/**
+ * A deploy Role refused the provider invoke its custom resource needs.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+const { Role } = await simAws.iam().createRole({
+  input: {
+    RoleName: "DeployRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "cloudformation.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  },
+});
+
+// Everything the template needs apart from the invoke of the provider.
+await simAws.iam().putRolePolicy({
+  input: {
+    RoleName: "DeployRole",
+    PolicyName: "DeployPolicy",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: ["cloudformation:*", "s3:*"],
+          Resource: "*",
+        },
+      ],
+    }),
+  },
+});
+
+try {
+  await simAws.cloudFormation().deployTemplate({
+    stackName: "uploads-stack",
+    caller: { kind: "arn", arn: Role.Arn },
+    template: {
+      Resources: {
+        Bucket: {
+          Type: "AWS::S3::Bucket",
+          Properties: { BucketName: "uploads" },
+        },
+        BucketNotifications: {
+          Type: "Custom::S3BucketNotifications",
+          Properties: {
+            ServiceToken: "arn:aws:lambda:us-east-1:888888888888:function:cdk",
+            BucketName: { Ref: "Bucket" },
+            NotificationConfiguration: {},
+            Managed: true,
+          },
+        },
+      },
+    },
+  });
+} catch (error) {
+  // is not authorized to perform: lambda:InvokeFunction on resource:
+  // arn:aws:lambda:us-east-1:888888888888:function:cdk
+  console.log((error as Error).message);
+}
+```
+
 ## S3 Bucket notifications
 
 The `NotificationConfiguration` property of `AWS::S3::Bucket` deploys through the ordinary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.17",
+  "version": "1.21.18",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",