@kensio/yulin 1.21.23 → 1.21.25

package/dist/service/wafv2/web-acl/sim-waf-association-config.js

@@ -1,11 +1,12 @@
-import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { unsimulatedSimWafBodyLimits } from "./sim-waf-unsimulated-body-limit.js";
 /**
  * How much of a request body WAF reads for a resource type given no
  * `AssociationConfig`.
  *
  * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
- * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
- * of either one here.
+ * and an AppSync API are fixed at 8 KB, and no simulated request reaches a web
+ * ACL through either one.
  */
 export const simWafBodyInspectionLimitBytes = 16_384;
 /**
@@ -17,11 +18,6 @@ const inspectionLimits = new Map([
     ["KB_48", 49_152],
     ["KB_64", 65_536],
 ]);
-const simulatedResourceTypes = [
-    "CLOUDFRONT",
-    "API_GATEWAY",
-    "COGNITO_USER_POOL",
-];
 /**
  * How much of a request body a web ACL's rules read, by resource type.
  *
@@ -36,15 +32,21 @@ export class SimWafBodyInspectionLimits {
     }
     /**
      * Read the limits an `AssociationConfig` sets, refusing anything WAF would
-     * refuse and anything this simulation cannot apply.
+     * refuse.
      */
     static read(input) {
-        const configured = Object.entries(input?.RequestBody ?? {});
-        const limits = new Map();
-        for (const [resourceType, config] of configured) {
-            limits.set(simulatedResourceType(resourceType), inspectionLimit(resourceType, config));
-        }
-        return new SimWafBodyInspectionLimits(limits);
+        return new SimWafBodyInspectionLimits(new Map(Object.entries(input?.RequestBody ?? {}).map(([resourceType, config]) => [
+            resourceType,
+            inspectionLimit(resourceType, config),
+        ])));
+    }
+    /**
+     * The limits set for resource types no simulated request passes through.
+     *
+     * Each is checked as WAF checks it and held, and applies to nothing.
+     */
+    get unsimulated() {
+        return unsimulatedSimWafBodyLimits(this.limits.keys());
     }
     /**
      * How many bytes of a body a request reaching one resource type is inspected
@@ -60,18 +62,6 @@ export class SimWafBodyInspectionLimits {
         return this.limits.get(resourceType) ?? simWafBodyInspectionLimitBytes;
     }
 }
-/**
- * Hold a `RequestBody` key to the resource types this simulation associates.
- */
-function simulatedResourceType(resourceType) {
-    const simulated = simulatedResourceTypes.find((candidate) => candidate === resourceType);
-    if (simulated === undefined) {
-        throw new SimWafUnsimulatedInputException(`AssociationConfig sets the body inspection limit for ${resourceType} ` +
-            `resources, and ${simulatedResourceTypes.join(" and ")} are the ` +
-            `types a web ACL goes in front of in Yulin`);
-    }
-    return simulated;
-}
 /**
  * Read one resource type's `DefaultSizeInspectionLimit`.
  *

package/dist/service/wafv2/web-acl/sim-waf-rule.d.ts

@@ -4,17 +4,29 @@ import type { SimWafRuleInput, SimWafRuleScope } from "./sim-waf-rule.type.js";
 /**
  * One rule of a web ACL, compiled so a request can be evaluated against it.
  *
- * The statement is turned into an evaluator when the web ACL is written, which
- * is what lets a rule Yulin cannot evaluate be refused at that point rather
- * than silently letting requests past later on.
+ * The statement is turned into an evaluator when the web ACL is written. A
+ * rule using something Yulin does not simulate is held all the same, as a
+ * rule that claims no request, and says why in `unsimulatedReason`. The web
+ * ACL reports it from there.
  */
 export declare class SimWafRule {
     #private;
     readonly name: string;
     readonly priority: number;
+    /**
+     * Why this rule claims no request, when it uses something Yulin does not
+     * simulate.
+     *
+     * AWS would evaluate it. A request it would have claimed goes on to the
+     * next rule here.
+     */
+    readonly unsimulatedReason: string | undefined;
     private constructor();
     /**
      * Compile one rule as it was written.
+     *
+     * Input WAFv2 itself would refuse is refused here too. A rule using
+     * something only Yulin leaves out compiles to one that claims nothing.
      */
     static compile(input: SimWafRuleInput, scope: SimWafRuleScope): SimWafRule;
     /**

package/dist/service/wafv2/web-acl/sim-waf-rule.js

@@ -1,16 +1,32 @@
+import { SimWafUnsimulatedInputException } from "../error/sim-wafv2.error.js";
 import { refuseUnsimulatedSimWafRuleInput, requiredSimWafRuleName, requiredSimWafRulePriority, } from "./sim-waf-rule-input.js";
 import { simWafRuleLabels } from "./sim-waf-rule-labels.js";
 import { compileSimWafRuleEvaluator } from "./sim-waf-rule-evaluator.js";
+/**
+ * What a rule held without being evaluated does with every request.
+ */
+function claimsNothing() {
+    // A held rule claims no request, so every request goes on to the next rule.
+}
 /**
  * One rule of a web ACL, compiled so a request can be evaluated against it.
  *
- * The statement is turned into an evaluator when the web ACL is written, which
- * is what lets a rule Yulin cannot evaluate be refused at that point rather
- * than silently letting requests past later on.
+ * The statement is turned into an evaluator when the web ACL is written. A
+ * rule using something Yulin does not simulate is held all the same, as a
+ * rule that claims no request, and says why in `unsimulatedReason`. The web
+ * ACL reports it from there.
  */
 export class SimWafRule {
     name;
     priority;
+    /**
+     * Why this rule claims no request, when it uses something Yulin does not
+     * simulate.
+     *
+     * AWS would evaluate it. A request it would have claimed goes on to the
+     * next rule here.
+     */
+    unsimulatedReason;
     #labels;
     #evaluate;
     constructor(properties) {
@@ -18,19 +34,39 @@ export class SimWafRule {
         this.priority = properties.priority;
         this.#labels = properties.labels;
         this.#evaluate = properties.evaluate;
+        this.unsimulatedReason = properties.unsimulatedReason;
     }
     /**
      * Compile one rule as it was written.
+     *
+     * Input WAFv2 itself would refuse is refused here too. A rule using
+     * something only Yulin leaves out compiles to one that claims nothing.
      */
     static compile(input, scope) {
         const name = requiredSimWafRuleName(input.Name);
-        refuseUnsimulatedSimWafRuleInput(input, name);
-        return new SimWafRule({
-            name,
-            priority: requiredSimWafRulePriority(input.Priority, name),
-            labels: simWafRuleLabels(input.RuleLabels, name),
-            evaluate: compileSimWafRuleEvaluator(input, name, scope),
-        });
+        const priority = requiredSimWafRulePriority(input.Priority, name);
+        const labels = simWafRuleLabels(input.RuleLabels, name);
+        try {
+            refuseUnsimulatedSimWafRuleInput(input, name);
+            return new SimWafRule({
+                name,
+                priority,
+                labels,
+                evaluate: compileSimWafRuleEvaluator(input, name, scope),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof SimWafUnsimulatedInputException)) {
+                throw error;
+            }
+            return new SimWafRule({
+                name,
+                priority,
+                labels,
+                evaluate: claimsNothing,
+                unsimulatedReason: error.message,
+            });
+        }
     }
     /**
      * What this rule does with a request, which is nothing when it does not

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.d.ts

@@ -2,9 +2,9 @@ import type { SimWafStatementInput } from "../statement/sim-waf-statement.type.j
 /**
  * What the statements that inspect a request cost.
  *
- * Only the kinds this simulation evaluates are counted. Every other kind is
- * refused where the rule is written, so a web ACL that has rules to add up
- * cannot hold one. Doubling the base cost for a JSON body never applies here
- * for the same reason.
+ * Only the kinds this simulation evaluates are counted. A rule using any
+ * other kind is held unevaluated and contributes nothing, so a web ACL holding
+ * one reports less than AWS would charge. Doubling the base cost for a JSON
+ * body never applies here for the same reason.
  */
 export declare function simWafMatchCapacity(statement: SimWafStatementInput): number;

package/dist/service/wafv2/web-acl/sim-waf-statement-capacity.js

@@ -19,10 +19,10 @@ const textTransformationCost = 10;
 /**
  * What the statements that inspect a request cost.
  *
- * Only the kinds this simulation evaluates are counted. Every other kind is
- * refused where the rule is written, so a web ACL that has rules to add up
- * cannot hold one. Doubling the base cost for a JSON body never applies here
- * for the same reason.
+ * Only the kinds this simulation evaluates are counted. A rule using any
+ * other kind is held unevaluated and contributes nothing, so a web ACL holding
+ * one reports less than AWS would charge. Doubling the base cost for a JSON
+ * body never applies here for the same reason.
  */
 export function simWafMatchCapacity(statement) {
     return (byteMatchCapacity(statement.ByteMatchStatement) +

package/dist/service/wafv2/web-acl/sim-waf-unsimulated-body-limit.d.ts

@@ -0,0 +1,6 @@
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
+/**
+ * What the body inspection limits a web ACL sets leave out, one part per
+ * resource type no simulated request passes through.
+ */
+export declare function unsimulatedSimWafBodyLimits(resourceTypes: Iterable<string>): readonly SimWafUnsimulatedPart[];

package/dist/service/wafv2/web-acl/sim-waf-unsimulated-body-limit.js

@@ -0,0 +1,23 @@
+/**
+ * The resource types a simulated request reaches a web ACL through.
+ */
+const simulatedResourceTypes = new Set([
+    "CLOUDFRONT",
+    "API_GATEWAY",
+    "COGNITO_USER_POOL",
+]);
+/**
+ * What the body inspection limits a web ACL sets leave out, one part per
+ * resource type no simulated request passes through.
+ */
+export function unsimulatedSimWafBodyLimits(resourceTypes) {
+    return [...resourceTypes]
+        .filter((resourceType) => !simulatedResourceTypes.has(resourceType))
+        .map((resourceType) => ({
+        part: `AssociationConfig.RequestBody.${resourceType}`,
+        reason: `AssociationConfig sets the body inspection limit for ` +
+            `${resourceType} resources, and ` +
+            `${[...simulatedResourceTypes].join(" and ")} are the types a ` +
+            `simulated request reaches a web ACL through`,
+    }));
+}

package/dist/service/wafv2/web-acl/sim-waf-web-acl-capacity.js

@@ -59,8 +59,8 @@ function nestedCapacity(statement) {
  *
  * A group is fixed at the capacity its owner gave it, and a scope-down
  * statement is charged on top. A group this simulation does not carry
- * contributes nothing, which cannot happen through a compiled web ACL: naming
- * one is refused where the rule is written.
+ * contributes nothing, so a web ACL holding one reports less than AWS would
+ * charge.
  */
 function managedGroupCapacity(statement) {
     const named = statement.ManagedRuleGroupStatement;

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.d.ts

@@ -13,6 +13,11 @@ export interface SimWafWebAclConfiguration {
     readonly visibilityConfig?: unknown;
     readonly description?: string | undefined;
     readonly associationConfig?: SimWafAssociationConfigInput | undefined;
+    /**
+     * The members held as written and not acted on, such as `CaptchaConfig`,
+     * keyed by the name the API gives them.
+     */
+    readonly heldMembers?: Readonly<Record<string, unknown>> | undefined;
 }
 /**
  * Read the action a request no rule claims is given.

package/dist/service/wafv2/web-acl/sim-waf-web-acl.d.ts

@@ -1,7 +1,7 @@
 import { type SimWafDecision } from "../evaluate/sim-waf-decision.js";
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
-import { type SimWafBodyInspectionResourceType } from "./sim-waf-association-config.js";
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAclRuleScope } from "./sim-waf-rule.type.js";
 import { type SimWafWebAclConfiguration } from "./sim-waf-web-acl-configuration.js";
 interface SimWafWebAclProperties extends SimWafResourceProperties, SimWafWebAclRuleScope {
@@ -33,6 +33,14 @@ export declare class SimWafWebAcl extends SimWafResource {
      * What this web ACL's rules add up to in capacity units.
      */
     get capacity(): number;
+    /**
+     * What this web ACL was written with and the simulation does not act on.
+     *
+     * A rule listed here claims no request, a member is held and does nothing,
+     * and a body inspection limit applies to no request. `GetWebACL` returns
+     * every one of them as written.
+     */
+    get unsimulated(): readonly SimWafUnsimulatedPart[];
     /**
      * What this web ACL was last written with, as the API reports it.
      */
@@ -42,6 +50,7 @@ export declare class SimWafWebAcl extends SimWafResource {
      *
      * The rules are compiled before anything is replaced, so a web ACL that
      * refuses an update keeps the rules it had rather than being left with none.
+     * The tags stay as they were created, since UpdateWebACL takes none.
      */
     reconfigure(configuration: SimWafWebAclConfiguration, lockToken: string | undefined): void;
     /**
@@ -51,7 +60,7 @@ export declare class SimWafWebAcl extends SimWafResource {
      * `AssociationConfig` raises it per resource type, and a web ACL written
      * without one reads the 16 KB default everything it protects has.
      */
-    bodyInspectionLimitBytes(resourceType: SimWafBodyInspectionResourceType | undefined): number;
+    bodyInspectionLimitBytes(resourceType: string | undefined): number;
     /**
      * Decide what happens to one request.
      */

package/dist/service/wafv2/web-acl/sim-waf-web-acl.js

@@ -1,7 +1,8 @@
 import { simWafDecision, } from "../evaluate/sim-waf-decision.js";
 import { simWafEvaluateRules } from "../evaluate/sim-waf-evaluate-rules.js";
+import { unsimulatedSimWafWebAclMembers } from "../command/web-acl/sim-wafv2-unsimulated-web-acl-input.js";
 import { SimWafResource, } from "../resource/sim-waf-resource.js";
-import { SimWafBodyInspectionLimits, } from "./sim-waf-association-config.js";
+import { SimWafBodyInspectionLimits } from "./sim-waf-association-config.js";
 import { compileSimWafWebAclRules } from "./sim-waf-rules.js";
 import { simWafWebAclCapacity } from "./sim-waf-web-acl-capacity.js";
 import { readSimWafDefaultAction, } from "./sim-waf-web-acl-configuration.js";
@@ -49,6 +50,23 @@ export class SimWafWebAcl extends SimWafResource {
     get capacity() {
         return this.#capacity;
     }
+    /**
+     * What this web ACL was written with and the simulation does not act on.
+     *
+     * A rule listed here claims no request, a member is held and does nothing,
+     * and a body inspection limit applies to no request. `GetWebACL` returns
+     * every one of them as written.
+     */
+    get unsimulated() {
+        return [
+            ...this.#rules.flatMap(({ name, unsimulatedReason }) => unsimulatedReason === undefined
+                ? []
+                : [{ part: `Rules.${name}`, reason: unsimulatedReason }]),
+            ...unsimulatedSimWafWebAclMembers(this.#configuration.heldMembers ?? {}),
+            ...this.#bodyInspectionLimits.unsimulated,
+            ...super.unsimulated,
+        ];
+    }
     /**
      * What this web ACL was last written with, as the API reports it.
      */
@@ -60,6 +78,7 @@ export class SimWafWebAcl extends SimWafResource {
      *
      * The rules are compiled before anything is replaced, so a web ACL that
      * refuses an update keeps the rules it had rather than being left with none.
+     * The tags stay as they were created, since UpdateWebACL takes none.
      */
     reconfigure(configuration, lockToken) {
         const defaultAction = readSimWafDefaultAction(configuration);

package/docs/services/dynamodb/README.md

@@ -1434,6 +1434,8 @@ from a different partition key is refused, since it names a collection this quer
 ## Reading a global secondary index
 
 Set `IndexName` on `Query` or `Scan` to read an index. Key conditions then use the index key schema.
+IAM authorizes the read against the index's own ARN, covered under
+[authorizing a read of an index](#authorizing-a-read-of-an-index).
 
 ```typescript sim-dynamodb-query-index
 /**
@@ -3716,6 +3718,26 @@ unauthorized caller cannot find out which names are taken.
 in the same way, each against the `dynamodb:` action of its own name. `ListTables` names no table.
 It authorizes against `*`.
 
+### Authorizing a read of an index
+
+A `Query` or `Scan` of the table authorizes against the table ARN. One naming an `IndexName`
+authorizes against the index's own ARN, the table ARN followed by `/index/` and the index name:
+
+```text
+arn:aws:dynamodb:eu-west-2:111111111111:table/OrdersTable/index/byStatus
+```
+
+Global and local secondary indexes work the same way. A statement allowing `dynamodb:Query` on the
+table ARN alone refuses a query of any index, with an `AccessDenied` naming the index ARN. A
+statement allowing only an index ARN refuses a query of the table. A caller that reads both needs
+the table ARN and `<table ARN>/index/*` (or each index ARN) in its policy.
+
+CDK's `grantReadData` and `grantReadWriteData` add `<table ARN>/index/*` only for a table construct
+that declares its indexes. A table imported with `Table.fromTableName` declares none, so its grant
+covers the table ARN alone, and a query of an index fails here as it fails on AWS. Import the table
+with `Table.fromTableAttributes` and its `globalIndexes` or `localIndexes` to have the grant cover
+them.
+
 ### Fine-grained access control with dynamodb:LeadingKeys
 
 `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`, `DeleteItem` and `BatchWriteItem`
@@ -3723,6 +3745,8 @@ supply the partition key values they reach as `dynamodb:LeadingKeys`. A policy c
 key restricts a caller to the items under particular partition keys. AWS scopes one user of a
 shared table to their own rows this way.
 
+A `Query` of an index supplies the index's partition key value, the value its key condition names.
+
 The condition takes the `ForAllValues:` qualifier, as AWS requires for this key. Every partition key
 value the request reaches has to match. A batch or a write naming one item outside the allowed set
 is refused whole, and nothing it asked for is applied.
@@ -3847,6 +3871,8 @@ is written.
   answering with the attributes it projects, and paging with a `LastEvaluatedKey` carrying the index
   key and the table key together. A local secondary index also answers a strongly consistent read,
   and fetches an unprojected attribute from the base table.
+- `Query` and `Scan` of an index authorized against the index ARN, for a global and a local
+  secondary index alike.
 - `dynamodb:LeadingKeys` on `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`,
   `DeleteItem` and `BatchWriteItem`, carrying the partition key values the request reaches so a
   `ForAllValues:` condition can scope a caller to particular items.