@kensio/yulin 1.21.23 → 1.21.25

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -12,7 +12,8 @@ interface SimDynamoDbAuthorizerProperties {
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export declare class SimDynamoDbAuthorizer {
     private readonly iam;
@@ -29,6 +30,23 @@ export declare class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, reached?: SimDynamoDbReached): SimAwsResolvedCaller;
     /**

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,12 +1,13 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
+import { simDynamoDbReadArn } from "../../table/sim-dynamodb-table-arn.js";
 import { simDynamoDbConditionContextOf } from "./sim-dynamodb-reached.js";
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export class SimDynamoDbAuthorizer {
     iam;
@@ -26,9 +27,26 @@ export class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action, tableName, caller, reached = {}) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, reached);
+        return this.authorizeResource(action, simDynamoDbReadArn(this.accountRegionScope, tableName, reached.indexName), caller, reached);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.d.ts

@@ -1,11 +1,14 @@
 /**
  * What one request reaches in the table it names.
  *
- * Each entry becomes a DynamoDB condition key. A request reaching nothing
- * under one of them leaves it out, as AWS leaves a key out for an operation
- * that reaches nothing it names.
+ * The partition key values and attribute names each become a DynamoDB
+ * condition key. A request reaching nothing under one of them leaves it out,
+ * as AWS leaves a key out for an operation that reaches nothing it names. The
+ * index name decides the resource authorized.
  */
 export interface SimDynamoDbReached {
+    /** The index the request reads, when it names one. */
+    readonly indexName?: string | undefined;
     /** The partition key values the request reaches. */
     readonly leadingKeys?: readonly string[] | undefined;
     /** The top-level attribute names the request names. */

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -33,11 +33,13 @@ export class SimDynamoDbQuery {
         const expressions = readSimDynamoDbQueryExpressions(input);
         // The one partition key the query reads is what authorization needs, and
         // reading it needs the view rather than the table, so it is read again
-        // here against whichever of the two the request names.
+        // here against whichever of the two the request names. A query naming an
+        // index is authorized against the index's own ARN.
         const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, {
             leadingKeys: (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
                 .partitionKeyValue),
             attributes: expressions.attributes,
+            indexName: input.IndexName,
         });
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan.js

@@ -37,9 +37,11 @@ export class SimDynamoDbScan {
         // input DynamoDB would refuse is refused whether or not the table is
         // there. A scan narrows nothing, so unlike a query its filter may name any
         // attribute, including a key attribute, and needs no key schema to check.
+        // A scan naming an index of either kind is authorized against the index's
+        // own ARN.
         const segment = readSimDynamoDbScanSegment(input);
         const expressions = readSimDynamoDbScanExpressions(input);
-        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes });
+        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes, indexName: input.IndexName });
         // What is being read is settled here: the table, or one of its indexes.
         const view = table.view(input.IndexName);
         const scan = view.scan();

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.d.ts

@@ -8,10 +8,14 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
  * The partition key values need the table to read them, so they arrive as a
  * function of it. The attribute names are read from the request's own
  * parameters before the table is reached, so they arrive as they are.
+ *
+ * A read naming one of the table's indexes carries the index name. The index
+ * is then the resource authorized.
  */
 export interface SimDynamoDbTableReach {
     readonly leadingKeys?: SimDynamoDbLeadingKeys | undefined;
     readonly attributes?: readonly string[] | undefined;
+    readonly indexName?: string | undefined;
 }
 /**
  * Resolve what a request reaches against the table it named.

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.js

@@ -9,6 +9,7 @@
  */
 export function simDynamoDbReachedIn(reach, table) {
     return {
+        indexName: reach.indexName,
         leadingKeys: table === undefined ? undefined : leadingKeysIn(reach, table),
         attributes: reach.attributes,
     };

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.d.ts

@@ -7,3 +7,16 @@ import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-
  * about to have, as real IAM does before the service handles the request.
  */
 export declare function simDynamoDbTableArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string): SimArn;
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export declare function simDynamoDbIndexArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string): SimArn;
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export declare function simDynamoDbReadArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string | undefined): SimArn;

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.js

@@ -7,3 +7,23 @@
 export function simDynamoDbTableArn(accountRegionScope, tableName) {
     return `arn:aws:dynamodb:${accountRegionScope.regionName}:${accountRegionScope.accountId}:table/${tableName}`;
 }
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export function simDynamoDbIndexArn(accountRegionScope, tableName, indexName) {
+    return `${simDynamoDbTableArn(accountRegionScope, tableName)}/index/${indexName}`;
+}
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export function simDynamoDbReadArn(accountRegionScope, tableName, indexName) {
+    if (indexName === undefined) {
+        return simDynamoDbTableArn(accountRegionScope, tableName);
+    }
+    return simDynamoDbIndexArn(accountRegionScope, tableName, indexName);
+}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources of one simulated AWS instance a web ACL can be put in front
  * of.
@@ -19,6 +20,9 @@ export class SimAwsWafProtectedResources {
      * Whether the resource an ARN names is one this scope holds.
      */
     has(resource) {
+        if (resource instanceof SimWafUnsimulatedResource) {
+            return true;
+        }
         if (resource.resourceType === "COGNITO_USER_POOL") {
             return this.hasUserPool(resource);
         }

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -1,4 +1,5 @@
 import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
 import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
 import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
@@ -32,6 +33,11 @@ export declare class SimWafAssociations implements SimWafProtection {
      * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
      */
     resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl: SimWafWebAcl): readonly SimWafUnsimulatedPart[];
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -1,4 +1,5 @@
 import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The web ACLs one Account and Region has in front of things.
  *
@@ -19,6 +20,9 @@ export class SimWafAssociations {
         this.#associations.set(resource.arn, {
             webAcl,
             resourceType: resource.resourceType,
+            unsimulatedReason: resource instanceof SimWafUnsimulatedResource
+                ? resource.reason
+                : undefined,
         });
     }
     /**
@@ -44,6 +48,19 @@ export class SimWafAssociations {
             .map(([resourceArn]) => resourceArn)
             .toArray();
     }
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .flatMap(([resourceArn, { unsimulatedReason }]) => unsimulatedReason === undefined
+            ? []
+            : [{ part: `Association.${resourceArn}`, reason: unsimulatedReason }])
+            .toArray();
+    }
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -1,13 +1,16 @@
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * A resource a `REGIONAL` web ACL can be put in front of.
  *
- * Two types are simulated. A third one joins this union and the reader below
- * gains a branch for it, and everything that holds an association goes on
+ * Requests reach a web ACL through two types here. The rest are held as
+ * `SimWafUnsimulatedResource`, associated and listed, with nothing evaluated
+ * in front of them. A type that starts serving requests gets a class of its
+ * own in this union, and everything that holds an association goes on
  * addressing a resource by its ARN.
  */
-export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool | SimWafUnsimulatedResource;
 /**
  * The type ListResourcesForWebACL lists one simulated resource under.
  */
@@ -21,17 +24,19 @@ export declare const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
 export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;

package/dist/service/wafv2/association/sim-waf-protected-resource.js

@@ -1,5 +1,6 @@
 import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource, simWafUnsimulatedResourceTypes, } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * The type ListResourcesForWebACL lists a simulated REST API stage under.
@@ -10,32 +11,28 @@ export const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
-export const simWafProtectedResourceTypes = [simWafApiGatewayResourceType, simWafUserPoolResourceType];
+export const simWafProtectedResourceTypes = [
+    simWafApiGatewayResourceType,
+    simWafUserPoolResourceType,
+    ...simWafUnsimulatedResourceTypes,
+];
 const restApiStagePattern = /^arn:aws:apigateway:(?<regionName>[^:]+)::\/restapis\/(?<restApiId>[^/]+)\/stages\/(?<stageName>[^/]+)$/u;
 const httpApiStagePattern = /^arn:aws:apigateway:[^:]+::\/apis\/[^/]+\/stages\/[^/]+$/u;
 const userPoolPattern = /^arn:aws:cognito-idp:(?<regionName>[^:]+):(?<accountId>[^:]+):userpool\/(?<userPoolId>[^/]+)$/u;
-/**
- * The resource types real WAF protects that this simulation does not, by the
- * service in their ARN.
- */
-const unsimulatedResources = new Map([
-    ["elasticloadbalancing", "an Application Load Balancer"],
-    ["appsync", "an AppSync GraphQL API"],
-    ["apprunner", "an App Runner service"],
-    ["amplify", "an Amplify app"],
-    ["ec2", "a Verified Access instance"],
-]);
+const amplifyAppPattern = /^arn:aws:amplify:[^:]+:[^:]+:apps\/[^/]+$/u;
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export function simWafProtectedResource(arn) {
     const stage = restApiStage(arn);
@@ -46,6 +43,10 @@ export function simWafProtectedResource(arn) {
     if (userPool !== undefined) {
         return userPool;
     }
+    const unsimulated = SimWafUnsimulatedResource.read(arn);
+    if (unsimulated !== undefined) {
+        return unsimulated;
+    }
     if (httpApiStagePattern.test(arn)) {
         throw new SimWafInvalidParameterException(`AWS WAF does not protect an API Gateway HTTP API. The resource types ` +
             `it protects cover a REST API stage and not an HTTP API stage, so ` +
@@ -87,13 +88,12 @@ function simWafUserPool(arn) {
     });
 }
 /**
- * Refuse an ARN naming a resource type AWS WAF protects and Yulin does not.
+ * Refuse an Amplify app, whose web ACL is out of this WAFv2's reach.
  */
 function refuseUnsimulatedResource(arn) {
-    const described = unsimulatedResources.get(arn.split(":", 3)[2] ?? "");
-    if (described !== undefined) {
-        throw new SimWafUnsimulatedInputException(`AWS WAF protects ${described}, and Yulin does not simulate a web ACL ` +
-            `in front of one, so ${arn} is refused rather than protected by ` +
-            `nothing.`);
+    if (amplifyAppPattern.test(arn)) {
+        throw new SimWafUnsimulatedInputException(`AWS WAF protects an Amplify app with a CLOUDFRONT web ACL held in ` +
+            `us-east-1, and a simulated WAFv2 associates web ACLs of its own ` +
+            `Region only, so ${arn} is refused.`);
     }
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts

@@ -9,20 +9,25 @@ import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
 export interface SimWafProtectedResources {
     /**
      * Whether this simulation holds the resource an ARN names.
+     *
+     * A `SimWafUnsimulatedResource` is held by no simulated service, so there is
+     * nothing to look for, and it is taken as named.
      */
     has(resource: SimWafProtectedResource): boolean;
 }
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export declare class SimWafNoProtectedResources implements SimWafProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has(): boolean;
+    has(resource: SimWafProtectedResource): boolean;
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.js

@@ -1,16 +1,19 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export class SimWafNoProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has() {
-        return false;
+    has(resource) {
+        return resource instanceof SimWafUnsimulatedResource;
     }
 }

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The resource types AWS WAF protects that no simulated request passes
+ * through, as ListResourcesForWebACL lists them.
+ */
+export type SimWafUnsimulatedResourceType = "APPLICATION_LOAD_BALANCER" | "APPSYNC" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE";
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export declare const simWafUnsimulatedResourceTypes: readonly SimWafUnsimulatedResourceType[];
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export declare class SimWafUnsimulatedResource {
+    readonly resourceType: SimWafUnsimulatedResourceType;
+    readonly arn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    readonly reason: string;
+    private constructor();
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn: string): SimWafUnsimulatedResource | undefined;
+}

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.js

@@ -0,0 +1,66 @@
+/**
+ * The ARN shapes AWS documents for each of them.
+ */
+const kinds = [
+    {
+        resourceType: "APPLICATION_LOAD_BALANCER",
+        described: "an Application Load Balancer",
+        pattern: /^arn:aws:elasticloadbalancing:[^:]+:[^:]+:loadbalancer\/app\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "APPSYNC",
+        described: "an AppSync GraphQL API",
+        pattern: /^arn:aws:appsync:[^:]+:[^:]+:apis\/[^/]+$/u,
+    },
+    {
+        resourceType: "APP_RUNNER_SERVICE",
+        described: "an App Runner service",
+        pattern: /^arn:aws:apprunner:[^:]+:[^:]+:service\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "VERIFIED_ACCESS_INSTANCE",
+        described: "a Verified Access instance",
+        pattern: /^arn:aws:ec2:[^:]+:[^:]+:verified-access-instance\/[^/]+$/u,
+    },
+];
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export const simWafUnsimulatedResourceTypes = kinds.map((kind) => kind.resourceType);
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export class SimWafUnsimulatedResource {
+    resourceType;
+    arn;
+    regionName;
+    accountId;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    reason;
+    constructor(arn, kind) {
+        const [regionName, accountId] = arn.split(":").slice(3, 5);
+        this.resourceType = kind.resourceType;
+        this.arn = arn;
+        this.regionName = String(regionName);
+        this.accountId = String(accountId);
+        this.reason =
+            `AWS WAF protects ${kind.described}, and no simulated request passes ` +
+                `through one, so the association with ${arn} is held and nothing in ` +
+                `front of it is evaluated`;
+    }
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn) {
+        const kind = kinds.find((candidate) => candidate.pattern.test(arn));
+        return kind && new SimWafUnsimulatedResource(arn, kind);
+    }
+}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "../../association/sim-waf-unsimulated-resource.js";
 import { SimWafUnavailableEntityException } from "../../error/sim-wafv2.error.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
 import { wafWebAclAssociationResourceType } from "../sim-cfn-waf-resource-types.js";
@@ -44,6 +45,10 @@ export class SimCfnWafAssociationCreator {
                     WebACLArn: association.webAclArn,
                 },
             }, options);
+            const unsimulated = SimWafUnsimulatedResource.read(association.resourceArn);
+            if (unsimulated !== undefined) {
+                resource.ignoreProperty("ResourceArn", unsimulated.reason);
+            }
             return association;
         });
     }

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.js

@@ -20,6 +20,7 @@ export class SimCfnWafIpSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             IPAddressVersion: this.text("IPAddressVersion"),
             Addresses: this.requiredStrings("Addresses"),
         };

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafIpSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafIpSetConfig } from "./sim-cfn-waf-ip-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafIpSetCreator {
             assertDefined(arn, `sim WAFv2 IP set ARN for CloudFormation Resource ${resource.logicalId}`);
             const ipSet = this.#wafV2.findIpSetByArn(arn);
             assertDefined(ipSet, `sim WAFv2 IP set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, ipSet);
             return ipSet;
         });
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-config.js

@@ -21,6 +21,7 @@ export class SimCfnWafRegexPatternSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             RegularExpressionList: this.requiredStrings("RegularExpressionList").map((pattern) => ({ RegexString: pattern })),
         };
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafRegexPatternSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafRegexPatternSetConfig } from "./sim-cfn-waf-regex-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafRegexPatternSetCreator {
             assertDefined(arn, `sim WAFv2 regex pattern set ARN for CloudFormation Resource ${resource.logicalId}`);
             const patternSet = this.#wafV2.findRegexPatternSetByArn(arn);
             assertDefined(patternSet, `sim WAFv2 regex pattern set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, patternSet);
             return patternSet;
         });
     }

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.d.ts

@@ -45,6 +45,10 @@ export declare abstract class SimCfnWafResourceConfig {
     /**
      * One property of the Resource, whatever shape it is in.
      */
+    /**
+     * The tags the template gave the Resource, as written.
+     */
+    tags(): readonly unknown[] | undefined;
     protected value(key: string): SimCfnTemplateValue | undefined;
     /**
      * One string property, or nothing when the template left it out.