@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/s3/bucket/sim-s3-bucket.d.ts

@@ -1,57 +1,28 @@
 import type { Brand } from "../../../util/brand.type.js";
-import { type SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimS3BucketStorage } from "../storage/s3-bucket-storage.js";
 import type { SimS3Object } from "../object/s3-object.js";
 import type { SimS3ObjectDeletion } from "./sim-s3-object-deletion.js";
+import type { SimS3TaggableObject } from "./tagging/sim-s3-taggable-object.js";
 import type { SimS3BucketObjectLock } from "./lock/sim-s3-bucket-object-lock.js";
 import type { SimS3BucketVersioning } from "./versioning/sim-s3-bucket-versioning.js";
 import type { SimS3BucketVersions } from "./versioning/sim-s3-bucket-versions.js";
 import type { SimS3ObjectVersion } from "./versioning/sim-s3-object-version.js";
-import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
-import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
-import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
 import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
-import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { SimS3BucketConfiguration } from "./sim-s3-bucket-configuration.js";
 import { SimS3BucketSystemMetadata } from "./sim-s3-bucket-system-metadata.js";
 import type { SimS3MultipartUploads } from "../upload/sim-s3-multipart-uploads.js";
+import type { SimS3BucketProperties } from "./sim-s3-bucket-properties.js";
 export type SimS3BucketName = Brand<string, "SimS3BucketName">;
-interface SimS3BucketProperties {
-    readonly bucketName: SimS3BucketName | string;
-    readonly accountRegionScope?: SimAwsAccountRegionScope;
-    readonly storage?: SimS3BucketStorage;
-    readonly website?: SimS3BucketWebsite;
-    readonly policy?: SimIamPolicyDocument | undefined;
-    readonly publicAccessBlock?: SimS3PublicAccessBlock;
-    readonly notifications?: SimS3NotificationConfiguration;
-    readonly lifecycle?: SimS3LifecycleConfiguration;
-    /**
-     * The simulation's sense of time, which is what a lifecycle rule is measured
-     * against. A Bucket made outside a simulated environment has none to be
-     * given, and runs on the host clock.
-     */
-    readonly clock?: SimClock;
-    /**
-     * When the Bucket came into being, in simulated time.
-     *
-     * Real S3 reports this on every Bucket a listing returns, and the `aws` CLI
-     * reads it from each entry, so a Bucket without one cannot be listed.
-     */
-    readonly creationDate?: Date;
-}
 /**
  * Simulated S3 Bucket.
  */
-export declare class SimS3Bucket {
+export declare class SimS3Bucket extends SimS3BucketConfiguration {
     readonly bucketName: SimS3BucketName;
     readonly creationDate: Date;
     private readonly accountRegionScope;
     private readonly systemMetadata;
     private readonly objects;
-    private website;
-    private policy;
-    private publicAccessBlock;
-    private notifications;
     constructor(properties: SimS3BucketProperties);
     /** Put an Object into storage, answering the version it was given, if any. */
     putObject(object: SimS3Object): Promise<SimS3ObjectVersion | undefined>;
@@ -75,6 +46,13 @@ export declare class SimS3Bucket {
      * refuses the removal of a version it is holding.
      */
     deleteObjectVersion(key: string, versionId: string, bypassGovernance?: boolean): Promise<SimS3ObjectVersion | undefined>;
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming no version acts on whatever a plain read of the key
+     * answers with, which is what real S3 does.
+     */
+    taggableObject(key: string, versionId?: string): Promise<SimS3TaggableObject>;
     /** The versions this Bucket keeps, and whether it keeps any. */
     getVersions(): SimS3BucketVersions;
     /** How this Bucket is locked, and what that does to a write and a delete. */
@@ -100,55 +78,6 @@ export declare class SimS3Bucket {
      * those Objects is served with the headers they had.
      */
     getDeclaredSystemMetadata(): SimS3BucketSystemMetadata;
-    /**
-     * Configure static website hosting for this simulated S3 Bucket.
-     */
-    configureWebsite(website: SimS3BucketWebsite): void;
-    /**
-     * Get static website configuration for this simulated S3 Bucket.
-     */
-    getWebsite(): SimS3BucketWebsite;
-    /**
-     * Configure the Bucket resource policy.
-     */
-    configurePolicy(policy: SimIamPolicyDocument): void;
-    /**
-     * Get the Bucket resource policy.
-     */
-    getPolicy(): SimIamPolicyDocument | undefined;
-    /**
-     * Remove the Bucket resource policy.
-     *
-     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
-     * whether there was a policy to remove.
-     */
-    deletePolicy(): void;
-    /**
-     * Replace this Bucket's Block Public Access settings.
-     */
-    configurePublicAccessBlock(publicAccessBlock: SimS3PublicAccessBlock): void;
-    /**
-     * Get this Bucket's Block Public Access settings.
-     */
-    getPublicAccessBlock(): SimS3PublicAccessBlock;
-    /**
-     * Remove this Bucket's Block Public Access settings.
-     *
-     * Removing the configuration returns the Bucket to the all-enabled state a
-     * new Bucket starts in, rather than leaving it unprotected.
-     */
-    deletePublicAccessBlock(): void;
-    /**
-     * Replace this Bucket's event notification configuration.
-     *
-     * Real S3 holds one configuration per Bucket rather than a list of them, so
-     * this replaces what was there instead of adding to it.
-     */
-    configureNotifications(notifications: SimS3NotificationConfiguration): void;
-    /**
-     * Get this Bucket's event notification configuration.
-     */
-    getNotifications(): SimS3NotificationConfiguration;
     /**
      * Replace this Bucket's lifecycle configuration.
      *
@@ -176,4 +105,3 @@ export declare class SimS3Bucket {
      */
     getWebsiteUrl(): URL;
 }
-export {};

package/dist/service/s3/bucket/sim-s3-bucket.js

@@ -1,37 +1,28 @@
 import { SimRealClock } from "../../../util/clock/sim-clock.js";
 import { MemoryS3BucketStorage } from "../storage/s3-memory-storage.js";
 import { SimS3BucketObjects } from "./sim-s3-bucket-objects.js";
-import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
-import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
-import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
 import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
 import { simS3BucketWebsiteUrl } from "./website/sim-s3-bucket-website-url.js";
 import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
 import { simAwsAccountRegionScopeFactory } from "../../aws/sim-aws-account-region-scope.factory.js";
+import { SimS3BucketConfiguration } from "./sim-s3-bucket-configuration.js";
 import { SimS3BucketSystemMetadata } from "./sim-s3-bucket-system-metadata.js";
 /**
  * Simulated S3 Bucket.
  */
-export class SimS3Bucket {
+export class SimS3Bucket extends SimS3BucketConfiguration {
     bucketName;
     creationDate;
     accountRegionScope;
     systemMetadata = new SimS3BucketSystemMetadata();
     objects;
-    website;
-    policy;
-    publicAccessBlock;
-    notifications;
     constructor(properties) {
-        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, publicAccessBlock = SimS3PublicAccessBlock.blockingAll(), notifications = SimS3NotificationConfiguration.empty(), lifecycle = SimS3LifecycleConfiguration.empty(), clock = new SimRealClock(), creationDate = clock.now(), } = properties;
+        super(properties);
+        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), lifecycle = SimS3LifecycleConfiguration.empty(), clock = new SimRealClock(), creationDate = clock.now(), } = properties;
         validateS3BucketName(bucketName);
         this.bucketName = bucketName;
         this.accountRegionScope = accountRegionScope;
         this.objects = new SimS3BucketObjects({ storage, lifecycle, clock });
-        this.website = website;
-        this.policy = policy;
-        this.publicAccessBlock = publicAccessBlock;
-        this.notifications = notifications;
         this.creationDate = creationDate;
     }
     /** Put an Object into storage, answering the version it was given, if any. */
@@ -66,6 +57,15 @@ export class SimS3Bucket {
     async deleteObjectVersion(key, versionId, bypassGovernance = false) {
         return await this.objects.deleteVersion(key, versionId, bypassGovernance);
     }
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming no version acts on whatever a plain read of the key
+     * answers with, which is what real S3 does.
+     */
+    async taggableObject(key, versionId) {
+        return await this.objects.taggable(key, versionId);
+    }
     /** The versions this Bucket keeps, and whether it keeps any. */
     getVersions() {
         return this.objects.sweptVersions();
@@ -103,75 +103,6 @@ export class SimS3Bucket {
     getDeclaredSystemMetadata() {
         return this.systemMetadata;
     }
-    /**
-     * Configure static website hosting for this simulated S3 Bucket.
-     */
-    configureWebsite(website) {
-        this.website = website;
-    }
-    /**
-     * Get static website configuration for this simulated S3 Bucket.
-     */
-    getWebsite() {
-        return this.website;
-    }
-    /**
-     * Configure the Bucket resource policy.
-     */
-    configurePolicy(policy) {
-        this.policy = policy;
-    }
-    /**
-     * Get the Bucket resource policy.
-     */
-    getPolicy() {
-        return this.policy;
-    }
-    /**
-     * Remove the Bucket resource policy.
-     *
-     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
-     * whether there was a policy to remove.
-     */
-    deletePolicy() {
-        this.policy = undefined;
-    }
-    /**
-     * Replace this Bucket's Block Public Access settings.
-     */
-    configurePublicAccessBlock(publicAccessBlock) {
-        this.publicAccessBlock = publicAccessBlock;
-    }
-    /**
-     * Get this Bucket's Block Public Access settings.
-     */
-    getPublicAccessBlock() {
-        return this.publicAccessBlock;
-    }
-    /**
-     * Remove this Bucket's Block Public Access settings.
-     *
-     * Removing the configuration returns the Bucket to the all-enabled state a
-     * new Bucket starts in, rather than leaving it unprotected.
-     */
-    deletePublicAccessBlock() {
-        this.publicAccessBlock = SimS3PublicAccessBlock.blockingAll();
-    }
-    /**
-     * Replace this Bucket's event notification configuration.
-     *
-     * Real S3 holds one configuration per Bucket rather than a list of them, so
-     * this replaces what was there instead of adding to it.
-     */
-    configureNotifications(notifications) {
-        this.notifications = notifications;
-    }
-    /**
-     * Get this Bucket's event notification configuration.
-     */
-    getNotifications() {
-        return this.notifications;
-    }
     /**
      * Replace this Bucket's lifecycle configuration.
      *
@@ -206,6 +137,6 @@ export class SimS3Bucket {
      * Get the simulated S3 static website URL for this Bucket.
      */
     getWebsiteUrl() {
-        return simS3BucketWebsiteUrl(this.bucketName, this.accountRegionScope, this.website);
+        return simS3BucketWebsiteUrl(this.bucketName, this.accountRegionScope, this.getWebsite());
     }
 }

package/dist/service/s3/bucket/sim-s3-public-read.fixture.d.ts

@@ -12,5 +12,11 @@ import type { SimS3 } from "../sim-s3.js";
  * issues exactly the two commands a real deployment issues rather than reaching
  * around them, so a test using it exercises the same path a user's own setup
  * would.
+ *
+ * The policy grants listing alongside the read. Real S3 admits that a key is
+ * missing only to a reader holding `s3:ListBucket`, and answers 403 to a
+ * reader holding the Object read alone. A site with its own error document, a
+ * folder redirect or a custom 404 error response grants both permissions for
+ * that reason.
  */
 export declare function grantPublicObjectRead(simS3: SimS3, bucketName: string): Promise<void>;

package/dist/service/s3/bucket/sim-s3-public-read.fixture.js

@@ -11,6 +11,12 @@
  * issues exactly the two commands a real deployment issues rather than reaching
  * around them, so a test using it exercises the same path a user's own setup
  * would.
+ *
+ * The policy grants listing alongside the read. Real S3 admits that a key is
+ * missing only to a reader holding `s3:ListBucket`, and answers 403 to a
+ * reader holding the Object read alone. A site with its own error document, a
+ * folder redirect or a custom 404 error response grants both permissions for
+ * that reason.
  */
 export async function grantPublicObjectRead(simS3, bucketName) {
     await simS3.putPublicAccessBlock({
@@ -27,12 +33,20 @@ export async function grantPublicObjectRead(simS3, bucketName) {
             Bucket: bucketName,
             Policy: JSON.stringify({
                 Version: "2012-10-17",
-                Statement: {
-                    Effect: "Allow",
-                    Principal: "*",
-                    Action: "s3:GetObject",
-                    Resource: `arn:aws:s3:::${bucketName}/*`,
-                },
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: "*",
+                        Action: "s3:GetObject",
+                        Resource: `arn:aws:s3:::${bucketName}/*`,
+                    },
+                    {
+                        Effect: "Allow",
+                        Principal: "*",
+                        Action: "s3:ListBucket",
+                        Resource: `arn:aws:s3:::${bucketName}`,
+                    },
+                ],
             }),
         },
     });

package/dist/service/s3/bucket/tagging/sim-s3-taggable-object.d.ts

@@ -0,0 +1,58 @@
+import type { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import type { SimS3BucketStorage } from "../../storage/s3-bucket-storage.js";
+import type { SimS3BucketVersions } from "../versioning/sim-s3-bucket-versions.js";
+/**
+ * What a tagging request names, as a Bucket can answer it.
+ *
+ * `stored` is what a plain read of the key answers with, which a request
+ * naming a version has no need of and passes as nothing.
+ */
+interface SimS3TaggingTarget {
+    readonly storage: SimS3BucketStorage;
+    readonly versions: SimS3BucketVersions;
+    readonly key: string;
+    readonly versionId: string | undefined;
+    readonly stored: SimS3Object | undefined;
+}
+/**
+ * The Object a tagging request names, ready to be read or retagged.
+ *
+ * A tag set lives on the Object, and an Object lives in two places at once on a
+ * Bucket that keeps versions: in storage under its key, and in the version
+ * history. Retagging the current Object has to reach both, or a read of the key
+ * and a read of the version would disagree about the tags. Retagging an older
+ * version reaches the history alone, since storage holds nothing of it.
+ */
+export declare class SimS3TaggableObject {
+    private readonly object;
+    private readonly storage;
+    private readonly version;
+    private readonly current;
+    private constructor();
+    /**
+     * Find the Object a tagging request names, or refuse the request the way
+     * real S3 refuses it.
+     *
+     * A key holding nothing is `NoSuchKey`, an id no version of it was given is
+     * `NoSuchVersion`, and a delete marker holds no Object to tag.
+     */
+    static named(target: SimS3TaggingTarget): SimS3TaggableObject;
+    /**
+     * The tags this Object carries.
+     */
+    get tagSet(): SimS3ObjectTagSet;
+    /**
+     * The version this Object is, on a Bucket keeping versions, which a tagging
+     * response reports back.
+     */
+    get versionId(): string | undefined;
+    /**
+     * Put a tag set on this Object, answering the Object as it now stands.
+     *
+     * The version is retagged first so that the Object written back to storage is
+     * the one the history holds, rather than an equal Object built alongside it.
+     */
+    retag(tags: SimS3ObjectTagSet): Promise<SimS3Object>;
+}
+export {};

package/dist/service/s3/bucket/tagging/sim-s3-taggable-object.js

@@ -0,0 +1,73 @@
+import { SimS3MethodNotAllowed, SimS3NoSuchKey, SimS3NoSuchVersion, } from "../../error/sim-s3.error.js";
+/**
+ * The Object a tagging request names, ready to be read or retagged.
+ *
+ * A tag set lives on the Object, and an Object lives in two places at once on a
+ * Bucket that keeps versions: in storage under its key, and in the version
+ * history. Retagging the current Object has to reach both, or a read of the key
+ * and a read of the version would disagree about the tags. Retagging an older
+ * version reaches the history alone, since storage holds nothing of it.
+ */
+export class SimS3TaggableObject {
+    object;
+    storage;
+    version;
+    current;
+    constructor(object, storage, version, current) {
+        this.object = object;
+        this.storage = storage;
+        this.version = version;
+        this.current = current;
+    }
+    /**
+     * Find the Object a tagging request names, or refuse the request the way
+     * real S3 refuses it.
+     *
+     * A key holding nothing is `NoSuchKey`, an id no version of it was given is
+     * `NoSuchVersion`, and a delete marker holds no Object to tag.
+     */
+    static named(target) {
+        const { storage, versions, key, versionId } = target;
+        if (versionId === undefined) {
+            if (target.stored === undefined) {
+                throw new SimS3NoSuchKey(`No S3 Object named ${key}`);
+            }
+            return new SimS3TaggableObject(target.stored, storage, versions.current(key), true);
+        }
+        const version = versions.find(key, versionId);
+        if (version === undefined) {
+            throw new SimS3NoSuchVersion(`No version ${versionId} of S3 Object ${key}`);
+        }
+        if (version.isDeleteMarker) {
+            throw new SimS3MethodNotAllowed(`Version ${versionId} of S3 Object ${key} is a delete marker`);
+        }
+        return new SimS3TaggableObject(version.object, storage, version, version === versions.current(key));
+    }
+    /**
+     * The tags this Object carries.
+     */
+    get tagSet() {
+        return this.object.tags;
+    }
+    /**
+     * The version this Object is, on a Bucket keeping versions, which a tagging
+     * response reports back.
+     */
+    get versionId() {
+        return this.version?.versionId;
+    }
+    /**
+     * Put a tag set on this Object, answering the Object as it now stands.
+     *
+     * The version is retagged first so that the Object written back to storage is
+     * the one the history holds, rather than an equal Object built alongside it.
+     */
+    async retag(tags) {
+        this.version?.tagged(tags);
+        const tagged = this.version?.object ?? this.object.withTags(tags);
+        if (this.current) {
+            await this.storage.putObject(tagged);
+        }
+        return tagged;
+    }
+}

package/dist/service/s3/bucket/versioning/sim-s3-object-version.d.ts

@@ -1,5 +1,7 @@
 import { SimS3ObjectLock } from "../lock/sim-s3-object-lock.js";
 import type { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import type { SimS3StorageClass } from "../../object/s3-storage-class.js";
 interface SimS3ObjectVersionProperties {
     readonly versionId: string;
     readonly key: string;
@@ -32,7 +34,7 @@ export declare class SimS3ObjectVersion {
     readonly lock: SimS3ObjectLock;
     private displaced;
     private readonly createdAt;
-    private readonly stored;
+    private stored;
     constructor(properties: SimS3ObjectVersionProperties);
     /**
      * The version an Object in a Bucket that keeps none reads back under.
@@ -41,6 +43,22 @@ export declare class SimS3ObjectVersion {
      * and answers ListObjectVersions for one as a history a single entry deep.
      */
     static nullVersionOf(object: SimS3Object): SimS3ObjectVersion;
+    /**
+     * Move the Object this version holds into another storage class.
+     *
+     * A lifecycle rule transitions a noncurrent version where it lies, so the
+     * class is recorded on the version rather than derived on each read of it. A
+     * delete marker holds no Object and transitions nowhere.
+     */
+    transitionTo(storageClass: SimS3StorageClass): void;
+    /**
+     * Replace the tags on the Object this version holds.
+     *
+     * Tags belong to the version they were put on, so tagging the current
+     * version leaves an older one carrying whatever it was written with. A
+     * delete marker holds no Object and carries no tags.
+     */
+    tagged(tags: SimS3ObjectTagSet): void;
     /**
      * Whether this version records a deletion instead of holding bytes.
      */

package/dist/service/s3/bucket/versioning/sim-s3-object-version.js

@@ -44,6 +44,26 @@ export class SimS3ObjectVersion {
             object,
         });
     }
+    /**
+     * Move the Object this version holds into another storage class.
+     *
+     * A lifecycle rule transitions a noncurrent version where it lies, so the
+     * class is recorded on the version rather than derived on each read of it. A
+     * delete marker holds no Object and transitions nowhere.
+     */
+    transitionTo(storageClass) {
+        this.stored = this.stored?.withStorageClass(storageClass);
+    }
+    /**
+     * Replace the tags on the Object this version holds.
+     *
+     * Tags belong to the version they were put on, so tagging the current
+     * version leaves an older one carrying whatever it was written with. A
+     * delete marker holds no Object and carries no tags.
+     */
+    tagged(tags) {
+        this.stored = this.stored?.withTags(tags);
+    }
     /**
      * Whether this version records a deletion instead of holding bytes.
      */

package/dist/service/s3/cfn/bucket/encryption/sim-cfn-s3-bucket-encryption.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3ServerSideEncryptionConfiguration } from "../../../bucket/encryption/sim-s3-bucket-encryption.js";
+/**
+ * Reads the `BucketEncryption` property of an AWS::S3::Bucket Resource into a
+ * PutBucketEncryption request.
+ *
+ * CloudFormation and the API disagree about one name. A template states
+ * `ServerSideEncryptionByDefault` inside each rule where the request states
+ * `ApplyServerSideEncryptionByDefault`, so that one is translated here and
+ * everything else is handed on as it was declared.
+ */
+export declare class SimCfnS3BucketEncryption {
+    private readonly properties;
+    private readonly shape;
+    constructor(logicalId: string, properties: SimCfnTemplateValueRecord);
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read(): SimS3ServerSideEncryptionConfiguration | undefined;
+    private readRule;
+}

package/dist/service/s3/cfn/bucket/encryption/sim-cfn-s3-bucket-encryption.js

@@ -0,0 +1,44 @@
+import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
+/**
+ * Reads the `BucketEncryption` property of an AWS::S3::Bucket Resource into a
+ * PutBucketEncryption request.
+ *
+ * CloudFormation and the API disagree about one name. A template states
+ * `ServerSideEncryptionByDefault` inside each rule where the request states
+ * `ApplyServerSideEncryptionByDefault`, so that one is translated here and
+ * everything else is handed on as it was declared.
+ */
+export class SimCfnS3BucketEncryption {
+    properties;
+    shape;
+    constructor(logicalId, properties) {
+        this.properties = properties;
+        this.shape = new SimCfnValueShape((reason) => s3BucketResourceError(logicalId, reason));
+    }
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read() {
+        const declared = this.properties["BucketEncryption"];
+        if (declared === undefined) {
+            return undefined;
+        }
+        const encryption = this.shape.record(declared, "BucketEncryption");
+        const rules = this.shape.list(encryption["ServerSideEncryptionConfiguration"] ?? [], "BucketEncryption ServerSideEncryptionConfiguration");
+        return { Rules: rules.map((rule, index) => this.readRule(rule, index)) };
+    }
+    readRule(value, index) {
+        const named = `BucketEncryption rule ${index}`;
+        const rule = this.shape.record(value, named);
+        const byDefault = rule["ServerSideEncryptionByDefault"];
+        return {
+            ...(byDefault !== undefined && {
+                ApplyServerSideEncryptionByDefault: this.shape.record(byDefault, `${named} ServerSideEncryptionByDefault`),
+            }),
+            ...(rule["BucketKeyEnabled"] !== undefined && {
+                BucketKeyEnabled: rule["BucketKeyEnabled"] === true,
+            }),
+        };
+    }
+}

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js

@@ -1,6 +1,7 @@
 import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
 import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
 import { simCfnS3CarriedRuleFields, simCfnS3RuleExpiration, simCfnS3RuleNoncurrentExpiration, simCfnS3StatedFields, } from "./sim-cfn-s3-bucket-lifecycle-fields.js";
+import { readSimCfnS3LifecycleFilter } from "./sim-cfn-s3-bucket-lifecycle-filter.js";
 import { readSimCfnS3LifecycleTransitions } from "./sim-cfn-s3-bucket-lifecycle-transitions.js";
 /**
  * Reads the `LifecycleConfiguration` property of an AWS::S3::Bucket Resource
@@ -43,6 +44,11 @@ export class SimCfnS3BucketLifecycleConfiguration {
             ...simCfnS3CarriedRuleFields(rule),
             ...simCfnS3StatedFields({
                 ID: rule["Id"],
+                Filter: readSimCfnS3LifecycleFilter({
+                    shape: this.shape,
+                    rule,
+                    path,
+                }),
                 Expiration: simCfnS3RuleExpiration(rule),
                 NoncurrentVersionExpiration: simCfnS3RuleNoncurrentExpiration(rule),
                 Transitions: readSimCfnS3LifecycleTransitions({

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.d.ts

@@ -6,10 +6,11 @@ import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../..
  * timing after it, where the request nests both. It carries the noncurrent
  * expiry both ways, as the nested object the request takes and as the older
  * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
- * `noncurrentVersionExpiration` synthesises. Everything absent from here,
- * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
- * object size bounds among them, is spelled the same way in both and goes
- * through untouched.
+ * `noncurrentVersionExpiration` synthesises. It also puts the tags a rule
+ * filters on beside the rule's `Prefix`, where the request holds both inside a
+ * `Filter`. Everything absent from here, `Status`,
+ * `AbortIncompleteMultipartUpload` and the object size bounds among them, is
+ * spelled the same way in both and goes through untouched.
  */
 export declare const simCfnS3TranslatedLifecycleFields: ReadonlySet<string>;
 /**