@kensio/yulin 1.21.22 → 1.21.24

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.js

@@ -0,0 +1,66 @@
+/**
+ * The ARN shapes AWS documents for each of them.
+ */
+const kinds = [
+    {
+        resourceType: "APPLICATION_LOAD_BALANCER",
+        described: "an Application Load Balancer",
+        pattern: /^arn:aws:elasticloadbalancing:[^:]+:[^:]+:loadbalancer\/app\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "APPSYNC",
+        described: "an AppSync GraphQL API",
+        pattern: /^arn:aws:appsync:[^:]+:[^:]+:apis\/[^/]+$/u,
+    },
+    {
+        resourceType: "APP_RUNNER_SERVICE",
+        described: "an App Runner service",
+        pattern: /^arn:aws:apprunner:[^:]+:[^:]+:service\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "VERIFIED_ACCESS_INSTANCE",
+        described: "a Verified Access instance",
+        pattern: /^arn:aws:ec2:[^:]+:[^:]+:verified-access-instance\/[^/]+$/u,
+    },
+];
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export const simWafUnsimulatedResourceTypes = kinds.map((kind) => kind.resourceType);
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export class SimWafUnsimulatedResource {
+    resourceType;
+    arn;
+    regionName;
+    accountId;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    reason;
+    constructor(arn, kind) {
+        const [regionName, accountId] = arn.split(":").slice(3, 5);
+        this.resourceType = kind.resourceType;
+        this.arn = arn;
+        this.regionName = String(regionName);
+        this.accountId = String(accountId);
+        this.reason =
+            `AWS WAF protects ${kind.described}, and no simulated request passes ` +
+                `through one, so the association with ${arn} is held and nothing in ` +
+                `front of it is evaluated`;
+    }
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn) {
+        const kind = kinds.find((candidate) => candidate.pattern.test(arn));
+        return kind && new SimWafUnsimulatedResource(arn, kind);
+    }
+}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "../../association/sim-waf-unsimulated-resource.js";
 import { SimWafUnavailableEntityException } from "../../error/sim-wafv2.error.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
 import { wafWebAclAssociationResourceType } from "../sim-cfn-waf-resource-types.js";
@@ -44,6 +45,10 @@ export class SimCfnWafAssociationCreator {
                     WebACLArn: association.webAclArn,
                 },
             }, options);
+            const unsimulated = SimWafUnsimulatedResource.read(association.resourceArn);
+            if (unsimulated !== undefined) {
+                resource.ignoreProperty("ResourceArn", unsimulated.reason);
+            }
             return association;
         });
     }

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.js

@@ -20,6 +20,7 @@ export class SimCfnWafIpSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             IPAddressVersion: this.text("IPAddressVersion"),
             Addresses: this.requiredStrings("Addresses"),
         };

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafIpSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafIpSetConfig } from "./sim-cfn-waf-ip-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafIpSetCreator {
             assertDefined(arn, `sim WAFv2 IP set ARN for CloudFormation Resource ${resource.logicalId}`);
             const ipSet = this.#wafV2.findIpSetByArn(arn);
             assertDefined(ipSet, `sim WAFv2 IP set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, ipSet);
             return ipSet;
         });
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-config.js

@@ -21,6 +21,7 @@ export class SimCfnWafRegexPatternSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             RegularExpressionList: this.requiredStrings("RegularExpressionList").map((pattern) => ({ RegexString: pattern })),
         };
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafRegexPatternSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafRegexPatternSetConfig } from "./sim-cfn-waf-regex-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafRegexPatternSetCreator {
             assertDefined(arn, `sim WAFv2 regex pattern set ARN for CloudFormation Resource ${resource.logicalId}`);
             const patternSet = this.#wafV2.findRegexPatternSetByArn(arn);
             assertDefined(patternSet, `sim WAFv2 regex pattern set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, patternSet);
             return patternSet;
         });
     }

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.d.ts

@@ -45,6 +45,10 @@ export declare abstract class SimCfnWafResourceConfig {
     /**
      * One property of the Resource, whatever shape it is in.
      */
+    /**
+     * The tags the template gave the Resource, as written.
+     */
+    tags(): readonly unknown[] | undefined;
     protected value(key: string): SimCfnTemplateValue | undefined;
     /**
      * One string property, or nothing when the template left it out.

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.js

@@ -57,6 +57,16 @@ export class SimCfnWafResourceConfig {
     /**
      * One property of the Resource, whatever shape it is in.
      */
+    /**
+     * The tags the template gave the Resource, as written.
+     */
+    tags() {
+        const tags = this.value("Tags");
+        if (tags !== undefined && !Array.isArray(tags)) {
+            this.refuse("Tags must be a list");
+        }
+        return tags;
+    }
     value(key) {
         // oxlint-disable-next-line security/detect-object-injection
         return this.properties[key] ?? undefined;

package/dist/service/wafv2/cfn/sim-cfn-waf-unsimulated.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimWafResource } from "../resource/sim-waf-resource.js";
+/**
+ * Record on a Resource each part of the WAFv2 resource it created that the
+ * simulation holds and does not act on.
+ *
+ * The path is the one `unsimulatedParts` reports, so `stack.ignoredProperties`
+ * and an SDK caller read the same names.
+ */
+export declare function simCfnWafRecordUnsimulated(resource: SimCfnResource, created: SimWafResource): void;

package/dist/service/wafv2/cfn/sim-cfn-waf-unsimulated.js

@@ -0,0 +1,12 @@
+/**
+ * Record on a Resource each part of the WAFv2 resource it created that the
+ * simulation holds and does not act on.
+ *
+ * The path is the one `unsimulatedParts` reports, so `stack.ignoredProperties`
+ * and an SDK caller read the same names.
+ */
+export function simCfnWafRecordUnsimulated(resource, created) {
+    for (const { part, reason } of created.unsimulated) {
+        resource.ignoreProperty(part, reason);
+    }
+}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.d.ts

@@ -8,26 +8,14 @@ import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
  * template wrote them. They are not read here at all: every rule is compiled
  * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
  * found, and reading them twice would mean two answers to the same question.
+ * The members Yulin holds without acting on are handed over the same way.
  */
 export declare class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     protected get resourceType(): string;
     /**
      * The input the web ACL this Resource describes is created from.
-     *
-     * The properties this simulation has no behaviour for are left out of it and
-     * recorded, so the web ACL deploys with the rest of what the template wrote.
-     * An SDK caller is refused for the same properties, because a request that
-     * was answered and then quietly dropped is a worse answer than a refusal.
      */
     createInput(): SimCreateWebAclCommandInput;
-    /**
-     * Record the web ACL members this simulation has no behaviour for.
-     *
-     * Each of them changes what a web ACL does on real WAF, so a web ACL
-     * deployed without one behaves differently to the one the template
-     * describes. `stack.ignoredProperties` is where a test reads that.
-     */
-    private recordUnsimulatedMembers;
     /**
      * The rules the template declared.
      *

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.js

@@ -1,4 +1,3 @@
-import { simWafUnsimulatedWebAclMembers } from "../../command/web-acl/sim-wafv2-unsimulated-web-acl-input.js";
 import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
 import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
 /**
@@ -9,6 +8,7 @@ import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
  * template wrote them. They are not read here at all: every rule is compiled
  * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
  * found, and reading them twice would mean two answers to the same question.
+ * The members Yulin holds without acting on are handed over the same way.
  */
 export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     get resourceType() {
@@ -16,39 +16,26 @@ export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     }
     /**
      * The input the web ACL this Resource describes is created from.
-     *
-     * The properties this simulation has no behaviour for are left out of it and
-     * recorded, so the web ACL deploys with the rest of what the template wrote.
-     * An SDK caller is refused for the same properties, because a request that
-     * was answered and then quietly dropped is a worse answer than a refusal.
      */
     createInput() {
-        this.recordUnsimulatedMembers();
         return {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             DefaultAction: this.value("DefaultAction"),
             Rules: this.rules(),
             VisibilityConfig: this.value("VisibilityConfig"),
             CustomResponseBodies: this.value("CustomResponseBodies"),
             AssociationConfig: this.value("AssociationConfig"),
+            CaptchaConfig: this.value("CaptchaConfig"),
+            ChallengeConfig: this.value("ChallengeConfig"),
+            TokenDomains: this.value("TokenDomains"),
+            DataProtectionConfig: this.value("DataProtectionConfig"),
+            OnSourceDDoSProtectionConfig: this.value("OnSourceDDoSProtectionConfig"),
+            ApplicationConfig: this.value("ApplicationConfig"),
         };
     }
-    /**
-     * Record the web ACL members this simulation has no behaviour for.
-     *
-     * Each of them changes what a web ACL does on real WAF, so a web ACL
-     * deployed without one behaves differently to the one the template
-     * describes. `stack.ignoredProperties` is where a test reads that.
-     */
-    recordUnsimulatedMembers() {
-        for (const [member, reason] of simWafUnsimulatedWebAclMembers) {
-            if (this.value(member) !== undefined) {
-                this.resource.ignoreProperty(member, `${member} is not simulated: ${reason}`);
-            }
-        }
-    }
     /**
      * The rules the template declared.
      *

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.d.ts

@@ -14,15 +14,10 @@ interface SimCfnWafWebAclCreatorProperties {
  * caller would have got: the same compilation of every rule, and the same
  * refusals.
  *
- * A rule this simulation cannot evaluate is the exception, and the two part
- * company over it. An SDK caller has the whole web ACL refused. A template
- * deploys the web ACL without that rule and records it on
- * `stack.ignoredProperties`, because the alternative is one rule taking a
- * user pool, a table and two functions in the same template down with it.
- *
- * The web ACL is then real, and thinner than the one the template describes.
- * That is the cost of deploying it at all, and the record of the dropped rule
- * is what a test reads to know the size of it.
+ * A rule or member this simulation cannot act on is held by the web ACL as the
+ * template wrote it, and recorded on `stack.ignoredProperties` under the name
+ * the web ACL reports it by. That record is what a test reads to know how far
+ * the deployed web ACL is from the one AWS would run.
  */
 export declare class SimCfnWafWebAclCreator {
     #private;

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.js

@@ -1,7 +1,7 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
-import { simCfnWafEvaluatableRules } from "./sim-cfn-waf-evaluatable-rules.js";
 import { SimCfnWafWebAclConfig } from "./sim-cfn-waf-web-acl-config.js";
 /**
  * Creates simulated web ACLs from AWS::WAFv2::WebACL Resources.
@@ -11,15 +11,10 @@ import { SimCfnWafWebAclConfig } from "./sim-cfn-waf-web-acl-config.js";
  * caller would have got: the same compilation of every rule, and the same
  * refusals.
  *
- * A rule this simulation cannot evaluate is the exception, and the two part
- * company over it. An SDK caller has the whole web ACL refused. A template
- * deploys the web ACL without that rule and records it on
- * `stack.ignoredProperties`, because the alternative is one rule taking a
- * user pool, a table and two functions in the same template down with it.
- *
- * The web ACL is then real, and thinner than the one the template describes.
- * That is the cost of deploying it at all, and the record of the dropped rule
- * is what a test reads to know the size of it.
+ * A rule or member this simulation cannot act on is held by the web ACL as the
+ * template wrote it, and recorded on `stack.ignoredProperties` under the name
+ * the web ACL reports it by. That record is what a test reads to know how far
+ * the deployed web ACL is from the one AWS would run.
  */
 export class SimCfnWafWebAclCreator {
     #wafV2;
@@ -34,16 +29,13 @@ export class SimCfnWafWebAclCreator {
             resource,
             properties,
         }).createInput();
-        const deployable = {
-            ...input,
-            Rules: simCfnWafEvaluatableRules(this.#wafV2, resource, input),
-        };
         return await simCfnWafResourceCommand(wafWebAclResourceType, resource.logicalId, async () => {
-            const created = await this.#wafV2.createWebAcl({ input: deployable }, options);
+            const created = await this.#wafV2.createWebAcl({ input }, options);
             const arn = created.Summary?.ARN;
             assertDefined(arn, `sim WAFv2 web ACL ARN for CloudFormation Resource ${resource.logicalId}`);
             const webAcl = this.#wafV2.findWebAclByArn(arn);
             assertDefined(webAcl, `sim WAFv2 web ACL ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, webAcl);
             return webAcl;
         });
     }

package/dist/service/wafv2/command/association/sim-wafv2-association-commands.js

@@ -1,6 +1,6 @@
 import { requiredSimWafArn } from "../sim-wafv2-input.js";
 import { simWafWebAclOutput } from "../web-acl/sim-waf-web-acl-output.js";
-import { simWafListedResourceType } from "./sim-wafv2-association-input.js";
+import { refuseSimWafAccountTakeoverForUserPool, simWafListedResourceType, } from "./sim-wafv2-association-input.js";
 /**
  * The commands that put a web ACL in front of a resource and take it away
  * again.
@@ -27,6 +27,7 @@ export class SimWafAssociationCommands {
         this.#access.authorizeWebAcl("wafv2:AssociateWebACL", webAclArn, options?.caller);
         const webAcl = this.#access.webAcl(webAclArn);
         this.#access.requireResource(resource);
+        refuseSimWafAccountTakeoverForUserPool(resource, webAcl);
         this.#associations.associate(resource, webAcl);
         return { $metadata: {} };
     }

package/dist/service/wafv2/command/association/sim-wafv2-association-input.d.ts

@@ -1,5 +1,6 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type SimWafProtectedResource, type SimWafProtectedResourceType } from "../../association/sim-waf-protected-resource.js";
+import type { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
 /**
  * Read the resource an association named, and hold it to one Account and
  * Region.
@@ -11,7 +12,14 @@ import { type SimWafProtectedResource, type SimWafProtectedResourceType } from "
  */
 export declare function simWafAssociationResource(resourceArn: string | undefined, accountRegionScope: SimAwsAccountRegionScope): SimWafProtectedResource;
 /**
- * Read the resource type a listing named, refusing one this simulation does
- * not hold.
+ * Read the resource type a listing named, refusing one WAFv2 does not list.
  */
 export declare function simWafListedResourceType(resourceType: string | undefined): SimWafProtectedResourceType;
+/**
+ * Refuse a web ACL carrying the account takeover group in front of a user
+ * pool, as AWS does.
+ *
+ * AWS refuses the whole association over the one rule group. Yulin holds the
+ * group without evaluating it, and this is where the refusal lands.
+ */
+export declare function refuseSimWafAccountTakeoverForUserPool(resource: SimWafProtectedResource, webAcl: SimWafWebAcl): void;

package/dist/service/wafv2/command/association/sim-wafv2-association-input.js

@@ -1,12 +1,9 @@
 import { simWafProtectedResource, simWafProtectedResourceTypes, } from "../../association/sim-waf-protected-resource.js";
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException } from "../../error/sim-wafv2.error.js";
 import { requiredSimWafArn } from "../sim-wafv2-input.js";
 /**
- * What ListResourcesForWebACL lists when the request names no resource type.
- *
- * Real WAFv2 documents that default, and it is not one of the types simulated
- * here. A listing that names nothing is refused, because the empty list a load
- * balancer listing produces reads as a web ACL protecting nothing.
+ * What ListResourcesForWebACL lists when the request names no resource type,
+ * as real WAFv2 documents it.
  */
 const defaultResourceType = "APPLICATION_LOAD_BALANCER";
 /**
@@ -32,21 +29,36 @@ export function simWafAssociationResource(resourceArn, accountRegionScope) {
     return resource;
 }
 /**
- * Read the resource type a listing named, refusing one this simulation does
- * not hold.
+ * Read the resource type a listing named, refusing one WAFv2 does not list.
  */
 export function simWafListedResourceType(resourceType) {
     const listed = resourceType ?? defaultResourceType;
     const simulated = simWafProtectedResourceTypes.find((candidate) => candidate === listed);
     if (simulated === undefined) {
-        throw new SimWafUnsimulatedInputException(`AWS WAF lists ${listed} resources, and ` +
-            `${simWafProtectedResourceTypes.join(" and ")} are the types Yulin ` +
-            `simulates. ListResourcesForWebACL lists ${defaultResourceType} when ` +
-            `a request names no ResourceType, so name one of the simulated types ` +
-            `to list the resources a web ACL protects.`);
+        throw new SimWafInvalidParameterException(`Error reason: ListResourcesForWebACL lists one of ` +
+            `${simWafProtectedResourceTypes.join(", ")}, field: RESOURCE_TYPE, ` +
+            `parameter: ${listed}`);
     }
     return simulated;
 }
+const accountTakeoverGroup = "AWSManagedRulesATPRuleSet";
+/**
+ * Refuse a web ACL carrying the account takeover group in front of a user
+ * pool, as AWS does.
+ *
+ * AWS refuses the whole association over the one rule group. Yulin holds the
+ * group without evaluating it, and this is where the refusal lands.
+ */
+export function refuseSimWafAccountTakeoverForUserPool(resource, webAcl) {
+    if (resource.resourceType !== "COGNITO_USER_POOL") {
+        return;
+    }
+    const carriesGroup = (webAcl.configuration.rules ?? []).some((rule) => rule.Statement?.ManagedRuleGroupStatement?.Name === accountTakeoverGroup);
+    if (carriesGroup) {
+        throw refusedResourceArn(`A web ACL carrying ${accountTakeoverGroup} cannot protect a Cognito ` +
+            `user pool`, resource.arn);
+    }
+}
 /**
  * The refusal a bad resource ARN reports, in the form WAFv2 writes.
  */

package/dist/service/wafv2/command/ip-set/sim-wafv2-ip-set-commands.d.ts

@@ -12,9 +12,9 @@ interface SimWafIpSetCommandsProperties {
 /**
  * The commands that make, read, list and remove IP sets.
  *
- * The addresses are held and reported and nothing evaluates them, because
- * `IPSetReferenceStatement` is refused: every request in this simulation comes
- * from 127.0.0.1.
+ * The addresses are held and reported and nothing evaluates them. A rule
+ * naming one with `IPSetReferenceStatement` is held unevaluated, because every
+ * request in this simulation comes from 127.0.0.1.
  */
 export declare class SimWafIpSetCommands {
     #private;

package/dist/service/wafv2/command/ip-set/sim-wafv2-ip-set-commands.js

@@ -1,14 +1,14 @@
 import { SimWafIpSet, requiredSimWafIpAddressVersion, } from "../../ip-set/sim-waf-ip-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove IP sets.
  *
- * The addresses are held and reported and nothing evaluates them, because
- * `IPSetReferenceStatement` is refused: every request in this simulation comes
- * from 127.0.0.1.
+ * The addresses are held and reported and nothing evaluates them. A rule
+ * naming one with `IPSetReferenceStatement` is held unevaluated, because every
+ * request in this simulation comes from 127.0.0.1.
  */
 export class SimWafIpSetCommands {
     #ipSets;
@@ -24,12 +24,12 @@ export class SimWafIpSetCommands {
      */
     createIpSet(command, options) {
         const { input } = command;
-        refuseSimWafTags(input.Tags, "CreateIPSet");
         const ipSet = new SimWafIpSet({
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
             description: checkedSimWafDescription(input.Description),
+            tags: input.Tags,
             ipAddressVersion: requiredSimWafIpAddressVersion(input.IPAddressVersion),
             addresses: input.Addresses ?? [],
         });

package/dist/service/wafv2/command/managed-rule-group/sim-wafv2-managed-rule-group-commands.js

@@ -30,11 +30,11 @@ export class SimWafManagedRuleGroupCommands {
             LabelNamespace: `${group.labelNamespace}:`,
             Rules: group.rules.map((rule) => ({
                 Name: rule.name,
-                Action: { Block: {} },
-            })),
-            AvailableLabels: group.rules.map((rule) => ({
-                Name: `${group.labelNamespace}:${rule.label}`,
+                Action: rule.counts === true ? { Count: {} } : { Block: {} },
             })),
+            AvailableLabels: group.rules
+                .flatMap((rule) => [rule.label, ...(rule.labels ?? [])])
+                .map((label) => ({ Name: `${group.labelNamespace}:${label}` })),
         };
     }
 }

package/dist/service/wafv2/command/regex-pattern-set/sim-wafv2-regex-pattern-set-commands.js

@@ -1,7 +1,7 @@
 import { SimWafRegexPatternSet } from "../../regex-pattern-set/sim-waf-regex-pattern-set.js";
 import { requiredSimWafScope } from "../../scope/sim-waf-scope.js";
 import { SimWafPage } from "../sim-wafv2-page.js";
-import { checkedSimWafDescription, refuseSimWafTags, requiredSimWafName, } from "../sim-wafv2-input.js";
+import { checkedSimWafDescription, requiredSimWafName, } from "../sim-wafv2-input.js";
 import { requireSimWafResource } from "../sim-wafv2-resource-lookup.js";
 /**
  * The commands that make, read, list and remove regex pattern sets.
@@ -24,12 +24,12 @@ export class SimWafRegexPatternSetCommands {
      */
     createRegexPatternSet(command, options) {
         const { input } = command;
-        refuseSimWafTags(input.Tags, "CreateRegexPatternSet");
         const patternSet = new SimWafRegexPatternSet({
             name: requiredSimWafName(input.Name),
             scope: requiredSimWafScope(input.Scope, this.#accountRegionScope.regionName),
             accountRegionScope: this.#accountRegionScope,
             description: checkedSimWafDescription(input.Description),
+            tags: input.Tags,
             regularExpressions: input.RegularExpressionList ?? [],
         });
         this.#authorizer.authorizeResource("wafv2:CreateRegexPatternSet", patternSet.arn, options?.caller);

package/dist/service/wafv2/command/sim-wafv2-input.d.ts

@@ -10,13 +10,6 @@ export declare function requiredSimWafName(name: string | undefined): string;
  * read, and so does this.
  */
 export declare function requiredSimWafId(id: string | undefined): string;
-/**
- * Refuse tags on a WAFv2 resource.
- *
- * Nothing here reads a tag, and a resource that reported tags it was never
- * asked about would be worse than one that says it does not carry them.
- */
-export declare function refuseSimWafTags(tags: readonly unknown[] | undefined, operation: string): void;
 /**
  * Read an ARN a request named, refusing a request with none.
  *

package/dist/service/wafv2/command/sim-wafv2-input.js

@@ -1,4 +1,4 @@
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, SimWafValidationException, } from "../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException, SimWafValidationException, } from "../error/sim-wafv2.error.js";
 /**
  * Read the name a request named, refusing a request with none.
  */
@@ -22,18 +22,6 @@ export function requiredSimWafId(id) {
     }
     return id;
 }
-/**
- * Refuse tags on a WAFv2 resource.
- *
- * Nothing here reads a tag, and a resource that reported tags it was never
- * asked about would be worse than one that says it does not carry them.
- */
-export function refuseSimWafTags(tags, operation) {
-    if (tags !== undefined && tags.length > 0) {
-        throw new SimWafUnsimulatedInputException(`WAFv2 resource tags are not simulated, so ${operation} refuses them ` +
-            `rather than dropping them`);
-    }
-}
 /**
  * Read an ARN a request named, refusing a request with none.
  *

package/dist/service/wafv2/command/web-acl/sim-waf-web-acl-output.js

@@ -18,5 +18,6 @@ export function simWafWebAclOutput(webAcl) {
         VisibilityConfig: configuration.visibilityConfig,
         CustomResponseBodies: configuration.customResponseBodies,
         AssociationConfig: configuration.associationConfig,
+        ...configuration.heldMembers,
     };
 }

package/dist/service/wafv2/command/web-acl/sim-wafv2-unsimulated-web-acl-input.d.ts

@@ -1,18 +1,15 @@
+import type { SimWafUnsimulatedPart } from "../../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAclWriteInput } from "./web-acl.command.js";
 /**
- * Why each web ACL member this simulation does not model is refused, by the
- * name a request and a template both write.
+ * The web ACL members a write carries that this simulation holds without
+ * acting on, keyed by member name.
  *
- * The refusal below and the CloudFormation layer read the same list. One
- * throws and the other records the member and deploys the web ACL without it,
- * and neither should be able to grow a reason the other has not got.
+ * Each of them changes what a web ACL does on real WAF. The web ACL keeps
+ * them, `GetWebACL` returns them as written, and `unsimulatedSimWafWebAclMembers`
+ * says which ones a request evaluated here goes without.
  */
-export declare const simWafUnsimulatedWebAclMembers: ReadonlyMap<string, string>;
+export declare function heldSimWafWebAclMembers(input: SimWafWebAclWriteInput): Readonly<Record<string, unknown>>;
 /**
- * Refuse the web ACL members this simulation does not model.
- *
- * Each of them changes what a web ACL does on real WAF, so accepting one and
- * dropping it would leave the web ACL looking configured to the request that
- * wrote it and unconfigured to every request it then evaluated.
+ * What a web ACL's held members leave out, one part per member.
  */
-export declare function refuseUnsimulatedSimWafWebAclInput(input: SimWafWebAclWriteInput, operation: string): void;
+export declare function unsimulatedSimWafWebAclMembers(members: Readonly<Record<string, unknown>>): readonly SimWafUnsimulatedPart[];