@kensio/yulin 1.21.24 → 1.21.25

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -12,7 +12,8 @@ interface SimDynamoDbAuthorizerProperties {
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export declare class SimDynamoDbAuthorizer {
     private readonly iam;
@@ -29,6 +30,23 @@ export declare class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, reached?: SimDynamoDbReached): SimAwsResolvedCaller;
     /**

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,12 +1,13 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
+import { simDynamoDbReadArn } from "../../table/sim-dynamodb-table-arn.js";
 import { simDynamoDbConditionContextOf } from "./sim-dynamodb-reached.js";
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export class SimDynamoDbAuthorizer {
     iam;
@@ -26,9 +27,26 @@ export class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action, tableName, caller, reached = {}) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, reached);
+        return this.authorizeResource(action, simDynamoDbReadArn(this.accountRegionScope, tableName, reached.indexName), caller, reached);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.d.ts

@@ -1,11 +1,14 @@
 /**
  * What one request reaches in the table it names.
  *
- * Each entry becomes a DynamoDB condition key. A request reaching nothing
- * under one of them leaves it out, as AWS leaves a key out for an operation
- * that reaches nothing it names.
+ * The partition key values and attribute names each become a DynamoDB
+ * condition key. A request reaching nothing under one of them leaves it out,
+ * as AWS leaves a key out for an operation that reaches nothing it names. The
+ * index name decides the resource authorized.
  */
 export interface SimDynamoDbReached {
+    /** The index the request reads, when it names one. */
+    readonly indexName?: string | undefined;
     /** The partition key values the request reaches. */
     readonly leadingKeys?: readonly string[] | undefined;
     /** The top-level attribute names the request names. */

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -33,11 +33,13 @@ export class SimDynamoDbQuery {
         const expressions = readSimDynamoDbQueryExpressions(input);
         // The one partition key the query reads is what authorization needs, and
         // reading it needs the view rather than the table, so it is read again
-        // here against whichever of the two the request names.
+        // here against whichever of the two the request names. A query naming an
+        // index is authorized against the index's own ARN.
         const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, {
             leadingKeys: (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
                 .partitionKeyValue),
             attributes: expressions.attributes,
+            indexName: input.IndexName,
         });
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan.js

@@ -37,9 +37,11 @@ export class SimDynamoDbScan {
         // input DynamoDB would refuse is refused whether or not the table is
         // there. A scan narrows nothing, so unlike a query its filter may name any
         // attribute, including a key attribute, and needs no key schema to check.
+        // A scan naming an index of either kind is authorized against the index's
+        // own ARN.
         const segment = readSimDynamoDbScanSegment(input);
         const expressions = readSimDynamoDbScanExpressions(input);
-        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes });
+        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes, indexName: input.IndexName });
         // What is being read is settled here: the table, or one of its indexes.
         const view = table.view(input.IndexName);
         const scan = view.scan();

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.d.ts

@@ -8,10 +8,14 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
  * The partition key values need the table to read them, so they arrive as a
  * function of it. The attribute names are read from the request's own
  * parameters before the table is reached, so they arrive as they are.
+ *
+ * A read naming one of the table's indexes carries the index name. The index
+ * is then the resource authorized.
  */
 export interface SimDynamoDbTableReach {
     readonly leadingKeys?: SimDynamoDbLeadingKeys | undefined;
     readonly attributes?: readonly string[] | undefined;
+    readonly indexName?: string | undefined;
 }
 /**
  * Resolve what a request reaches against the table it named.

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.js

@@ -9,6 +9,7 @@
  */
 export function simDynamoDbReachedIn(reach, table) {
     return {
+        indexName: reach.indexName,
         leadingKeys: table === undefined ? undefined : leadingKeysIn(reach, table),
         attributes: reach.attributes,
     };

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.d.ts

@@ -7,3 +7,16 @@ import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-
  * about to have, as real IAM does before the service handles the request.
  */
 export declare function simDynamoDbTableArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string): SimArn;
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export declare function simDynamoDbIndexArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string): SimArn;
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export declare function simDynamoDbReadArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string | undefined): SimArn;

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.js

@@ -7,3 +7,23 @@
 export function simDynamoDbTableArn(accountRegionScope, tableName) {
     return `arn:aws:dynamodb:${accountRegionScope.regionName}:${accountRegionScope.accountId}:table/${tableName}`;
 }
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export function simDynamoDbIndexArn(accountRegionScope, tableName, indexName) {
+    return `${simDynamoDbTableArn(accountRegionScope, tableName)}/index/${indexName}`;
+}
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export function simDynamoDbReadArn(accountRegionScope, tableName, indexName) {
+    if (indexName === undefined) {
+        return simDynamoDbTableArn(accountRegionScope, tableName);
+    }
+    return simDynamoDbIndexArn(accountRegionScope, tableName, indexName);
+}

package/docs/services/dynamodb/README.md

@@ -1434,6 +1434,8 @@ from a different partition key is refused, since it names a collection this quer
 ## Reading a global secondary index
 
 Set `IndexName` on `Query` or `Scan` to read an index. Key conditions then use the index key schema.
+IAM authorizes the read against the index's own ARN, covered under
+[authorizing a read of an index](#authorizing-a-read-of-an-index).
 
 ```typescript sim-dynamodb-query-index
 /**
@@ -3716,6 +3718,26 @@ unauthorized caller cannot find out which names are taken.
 in the same way, each against the `dynamodb:` action of its own name. `ListTables` names no table.
 It authorizes against `*`.
 
+### Authorizing a read of an index
+
+A `Query` or `Scan` of the table authorizes against the table ARN. One naming an `IndexName`
+authorizes against the index's own ARN, the table ARN followed by `/index/` and the index name:
+
+```text
+arn:aws:dynamodb:eu-west-2:111111111111:table/OrdersTable/index/byStatus
+```
+
+Global and local secondary indexes work the same way. A statement allowing `dynamodb:Query` on the
+table ARN alone refuses a query of any index, with an `AccessDenied` naming the index ARN. A
+statement allowing only an index ARN refuses a query of the table. A caller that reads both needs
+the table ARN and `<table ARN>/index/*` (or each index ARN) in its policy.
+
+CDK's `grantReadData` and `grantReadWriteData` add `<table ARN>/index/*` only for a table construct
+that declares its indexes. A table imported with `Table.fromTableName` declares none, so its grant
+covers the table ARN alone, and a query of an index fails here as it fails on AWS. Import the table
+with `Table.fromTableAttributes` and its `globalIndexes` or `localIndexes` to have the grant cover
+them.
+
 ### Fine-grained access control with dynamodb:LeadingKeys
 
 `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`, `DeleteItem` and `BatchWriteItem`
@@ -3723,6 +3745,8 @@ supply the partition key values they reach as `dynamodb:LeadingKeys`. A policy c
 key restricts a caller to the items under particular partition keys. AWS scopes one user of a
 shared table to their own rows this way.
 
+A `Query` of an index supplies the index's partition key value, the value its key condition names.
+
 The condition takes the `ForAllValues:` qualifier, as AWS requires for this key. Every partition key
 value the request reaches has to match. A batch or a write naming one item outside the allowed set
 is refused whole, and nothing it asked for is applied.
@@ -3847,6 +3871,8 @@ is written.
   answering with the attributes it projects, and paging with a `LastEvaluatedKey` carrying the index
   key and the table key together. A local secondary index also answers a strongly consistent read,
   and fetches an unprojected attribute from the base table.
+- `Query` and `Scan` of an index authorized against the index ARN, for a global and a local
+  secondary index alike.
 - `dynamodb:LeadingKeys` on `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`,
   `DeleteItem` and `BatchWriteItem`, carrying the partition key values the request reaches so a
   `ForAllValues:` condition can scope a caller to particular items.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.24",
+  "version": "1.21.25",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -293,7 +293,7 @@
     "eslint-plugin-jsdoc": "^64.0.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
-    "eslint-plugin-unicorn": "^73.0.0",
+    "eslint-plugin-unicorn": "^74.0.0",
     "execa": "^10.0.0",
     "fta-cli": "^3.0.0",
     "hyparquet": "^1.29.2",