@kensio/yulin 1.21.33 → 1.22.0

package/dist/service/cloudformation/registry/sim-cfn-resource-arn.d.ts

@@ -0,0 +1,46 @@
+import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../template/value/sim-cfn-template-value.js";
+interface SimCfnResourceArnProperties {
+    readonly resource: SimCfnResource;
+    readonly arnFormat: string;
+    readonly resolvedProperties: SimCfnTemplateValueRecord;
+}
+/**
+ * The ARN a read handler's calls on one Resource are authorized on.
+ *
+ * The ARN format's variables are filled from the Stack's scope and from the
+ * Resource's own properties, which is the whole of it for a Resource whose
+ * template names it (`DomainName` and `RepositoryName` on a CodeArtifact
+ * repository). A Resource whose name CloudFormation generated holds no such
+ * property. Its ARN comes from its `Arn` attribute, from a Ref that is an ARN, or
+ * from its Ref where the format has one variable left, all of which a service answers once it has
+ * created the Resource.
+ *
+ * An ARN that cannot be built is refused. Authorizing the calls on a guessed
+ * ARN would let a policy scoped to the real one pass or fail by accident.
+ */
+export declare class SimCfnResourceArn {
+    private readonly resource;
+    private readonly arnFormat;
+    private readonly resolvedProperties;
+    constructor(properties: SimCfnResourceArnProperties);
+    /** The Resource's ARN, or a refusal saying which variable could not be filled. */
+    value(): string;
+    private filled;
+    private unfilledVariables;
+    private variable;
+    private property;
+    /**
+     * The property an ARN variable is held in under another name. The Service
+     * Authorization Reference names a CodeBuild project's `${ProjectName}`,
+     * which `AWS::CodeBuild::Project` calls `Name`.
+     */
+    private namePropertyFor;
+    /**
+     * A value the Resource answers once a service has created it. A Resource
+     * that was skipped answers with a stand-in naming itself, which is no part
+     * of an ARN.
+     */
+    private deployedValue;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-resource-arn.js

@@ -0,0 +1,119 @@
+const variablePattern = /\$\{(?<name>[^}]+)\}/gu;
+/**
+ * The ARN a read handler's calls on one Resource are authorized on.
+ *
+ * The ARN format's variables are filled from the Stack's scope and from the
+ * Resource's own properties, which is the whole of it for a Resource whose
+ * template names it (`DomainName` and `RepositoryName` on a CodeArtifact
+ * repository). A Resource whose name CloudFormation generated holds no such
+ * property. Its ARN comes from its `Arn` attribute, from a Ref that is an ARN, or
+ * from its Ref where the format has one variable left, all of which a service answers once it has
+ * created the Resource.
+ *
+ * An ARN that cannot be built is refused. Authorizing the calls on a guessed
+ * ARN would let a policy scoped to the real one pass or fail by accident.
+ */
+export class SimCfnResourceArn {
+    resource;
+    arnFormat;
+    resolvedProperties;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.arnFormat = properties.arnFormat;
+        this.resolvedProperties = new Map(Object.entries(properties.resolvedProperties));
+    }
+    /** The Resource's ARN, or a refusal saying which variable could not be filled. */
+    value() {
+        const unfilled = this.unfilledVariables();
+        if (unfilled.length === 0) {
+            return this.filled();
+        }
+        const arnAttribute = this.deployedValue(() => {
+            return this.resource.attributeValue("Arn");
+        });
+        if (arnAttribute?.startsWith("arn:") === true) {
+            return arnAttribute;
+        }
+        const refValue = this.deployedValue(() => this.resource.refValue);
+        // An SNS topic's Ref is its whole ARN, where a hosted zone's is the one
+        // identifier its ARN format lacks.
+        if (refValue?.startsWith("arn:") === true) {
+            return refValue;
+        }
+        const [onlyUnfilled] = unfilled;
+        if (refValue !== undefined && unfilled.length === 1) {
+            return this.filled(new Map([[onlyUnfilled, refValue]]));
+        }
+        throw new Error(`Sim CloudFormation cannot authorize the read handler of Resource ${this.resource.logicalId} (${String(this.resource.type)}): its ARN format ${this.arnFormat} needs ${unfilled.join(", ")}, which neither its properties nor its attributes give`);
+    }
+    filled(extra = new Map()) {
+        return this.arnFormat.replaceAll(variablePattern, (_match, name) => {
+            return extra.get(name) ?? this.variable(name) ?? "";
+        });
+    }
+    unfilledVariables() {
+        return this.arnFormat
+            .matchAll(variablePattern)
+            .map((match) => match.groups?.["name"] ?? "")
+            .filter((name) => this.variable(name) === undefined)
+            .toArray();
+    }
+    variable(name) {
+        const { accountId, regionName } = this.resource.accountRegionScope;
+        switch (name) {
+            case "Partition": {
+                return "aws";
+            }
+            case "Region": {
+                return regionName;
+            }
+            case "Account": {
+                return accountId;
+            }
+            default: {
+                return this.property(name) ?? this.property(this.namePropertyFor(name));
+            }
+        }
+    }
+    property(name) {
+        return stringValue(this.resolvedProperties.get(name));
+    }
+    /**
+     * The property an ARN variable is held in under another name. The Service
+     * Authorization Reference names a CodeBuild project's `${ProjectName}`,
+     * which `AWS::CodeBuild::Project` calls `Name`.
+     */
+    namePropertyFor(variable) {
+        const typeName = this.resource.type?.split("::").at(-1);
+        if (variable === `${String(typeName)}Name`) {
+            return "Name";
+        }
+        return variable;
+    }
+    /**
+     * A value the Resource answers once a service has created it. A Resource
+     * that was skipped answers with a stand-in naming itself, which is no part
+     * of an ARN.
+     */
+    deployedValue(read) {
+        const { createComplete, skipped, inert } = this.resource;
+        if (!createComplete || skipped || inert) {
+            return undefined;
+        }
+        // A Resource type with no Arn attribute refuses to answer for one, which
+        // here only means the ARN has to come from somewhere else.
+        try {
+            return stringValue(read());
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** The value where it is a string, which is all an ARN can be made of. */
+function stringValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return undefined;
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.d.ts

@@ -1,3 +1,4 @@
+import type { SimAws } from "../../aws/sim-aws.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 /**
@@ -18,13 +19,17 @@ export interface SimCfnStackUpdateContext {
  * values the deployment started with.
  */
 export declare class SimCfnStackDeployContext {
+    /** The simulation the Stack deploys into, which an update never moves. */
+    readonly simAws: SimAws;
     /** The CDK cloud assembly the Stack's template was synthesized into. */
     cdkOutContext: SimCdkOutContext | undefined;
     /** The principal the Stack's Resource work is authorized as. */
     caller: SimAwsCaller | undefined;
     /** The principal the Stack's CDK file assets are published as. */
     assetsCaller: SimAwsCaller | undefined;
-    constructor(properties: SimCfnStackUpdateContext);
+    constructor(properties: SimCfnStackUpdateContext & {
+        readonly simAws: SimAws;
+    });
     /**
      * Take on what an update brings with it, for this and every later operation.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.js

@@ -7,6 +7,8 @@
  * values the deployment started with.
  */
 export class SimCfnStackDeployContext {
+    /** The simulation the Stack deploys into, which an update never moves. */
+    simAws;
     /** The CDK cloud assembly the Stack's template was synthesized into. */
     cdkOutContext;
     /** The principal the Stack's Resource work is authorized as. */
@@ -14,6 +16,7 @@ export class SimCfnStackDeployContext {
     /** The principal the Stack's CDK file assets are published as. */
     assetsCaller;
     constructor(properties) {
+        this.simAws = properties.simAws;
         this.cdkOutContext = properties.cdkOutContext;
         this.caller = properties.caller;
         this.assetsCaller = properties.assetsCaller;

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -4,7 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
-import { type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
+import { SimCfnStackDeployContext, type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
 import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
@@ -53,12 +53,13 @@ interface SimCfnStackResourceOperationsProperties {
  * ordering of the work itself.
  */
 export declare class SimCfnStackResourceOperations {
+    /** What the Stack deploys from, into and as. */
+    readonly context: SimCfnStackDeployContext;
     private readonly simAws;
     private readonly accountRegionScope;
     private readonly stackName;
     private readonly bindings;
     private readonly resourceOrder;
-    private readonly context;
     /**
      * Resources an update kept in simulated AWS.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -20,12 +20,13 @@ import { SimCfnStackResourceUpdates } from "./update/sim-cfn-stack-resource-upda
  * ordering of the work itself.
  */
 export class SimCfnStackResourceOperations {
+    /** What the Stack deploys from, into and as. */
+    context;
     simAws;
     accountRegionScope;
     stackName;
     bindings;
     resourceOrder;
-    context;
     /**
      * Resources an update kept in simulated AWS.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -3,6 +3,7 @@ import { makeSimCfnStackResourceMap } from "./resource-map/sim-cfn-stack-resourc
 import { SimCfnStackResourceLookup } from "./resource-map/sim-cfn-stack-resource-lookup.js";
 import { SimCfnStackDeploymentLifecycle } from "./deploy/sim-cfn-stack-deployment-lifecycle.js";
 import { SimCfnStackResourceOperations } from "./sim-cfn-stack-resource-operations.js";
+import { SimCfnReadHandlerAuthorizer } from "../registry/sim-cfn-read-handler-authorizer.js";
 import { SimCfnStackUpdateLifecycle } from "./update/sim-cfn-stack-update-lifecycle.js";
 import { SimCfnStackOutputs } from "./output/sim-cfn-stack-outputs.js";
 import { SimCfnStackOutputLookup } from "./output/sim-cfn-stack-output-lookup.js";
@@ -148,6 +149,14 @@ export class SimCfnStack {
         await this.updating.update({
             apply: async () => {
                 await updater.apply();
+                // Resolving an output reads an untouched Resource through its read
+                // handler. A rollback makes no such call, so it has no step here.
+                await new SimCfnReadHandlerAuthorizer({
+                    context: this.operations.context,
+                }).authorizeUpdate(updater.plan, {
+                    updated: template,
+                    resources: this.resourceMap,
+                });
                 this.resolveOutputs();
             },
             rollBack: async () => {

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import type { CfnTemplateBodyRecord } from "../../template/sim-cfn-template.js";
 import { type SimCfnStackInPlaceUpdates } from "./sim-cfn-stack-resource-changes.js";
 import { type SimCfnStackResourceChange } from "./sim-cfn-stack-resource-change-pairs.js";
 interface SimCfnStackUpdatePlanProperties {
@@ -39,6 +40,11 @@ export declare class SimCfnStackUpdatePlan {
      */
     readonly creations: readonly SimCfnResource[];
     readonly updated: ReadonlyMap<string, SimCfnResource>;
+    /**
+     * The deployed Resources the new template describes unchanged, which the
+     * update leaves where they are.
+     */
+    readonly untouched: readonly SimCfnResource[];
     constructor(properties: SimCfnStackUpdatePlanProperties);
     /**
      * What the update's deletions are to leave in simulated AWS.
@@ -49,6 +55,11 @@ export declare class SimCfnStackUpdatePlan {
      * deletes that Resource.
      */
     retention(): SimCfnResourceRetention;
+    /**
+     * The untouched Resources whose attributes the template reads, through
+     * `Fn::GetAtt` or `Fn::Sub`.
+     */
+    untouchedReadBy(template: CfnTemplateBodyRecord): SimCfnResource[];
     /**
      * Whether the update changes any Resource at all.
      *

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.js

@@ -1,4 +1,5 @@
 import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import { simCfnAttributeReads } from "../../registry/sim-cfn-attribute-reads.js";
 import { simCfnStackResourceChanges, } from "./sim-cfn-stack-resource-changes.js";
 import { simCfnStackResourceChangePairs, } from "./sim-cfn-stack-resource-change-pairs.js";
 /**
@@ -33,6 +34,11 @@ export class SimCfnStackUpdatePlan {
      */
     creations;
     updated;
+    /**
+     * The deployed Resources the new template describes unchanged, which the
+     * update leaves where they are.
+     */
+    untouched;
     constructor(properties) {
         const { current, updated, inPlaceUpdates } = properties;
         const { replaced, updatedInPlace } = simCfnStackResourceChanges({
@@ -57,6 +63,14 @@ export class SimCfnStackUpdatePlan {
             return (!current.has(resource.logicalId) || replaced.has(resource.logicalId));
         })
             .toArray();
+        this.untouched = current
+            .values()
+            .filter(({ logicalId }) => {
+            return (updated.has(logicalId) &&
+                !replaced.has(logicalId) &&
+                !updatedInPlace.has(logicalId));
+        })
+            .toArray();
     }
     /**
      * What the update's deletions are to leave in simulated AWS.
@@ -74,6 +88,14 @@ export class SimCfnStackUpdatePlan {
             ])),
         });
     }
+    /**
+     * The untouched Resources whose attributes the template reads, through
+     * `Fn::GetAtt` or `Fn::Sub`.
+     */
+    untouchedReadBy(template) {
+        const reads = simCfnAttributeReads(template);
+        return this.untouched.filter(({ logicalId }) => reads.has(logicalId));
+    }
     /**
      * Whether the update changes any Resource at all.
      *

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.d.ts

@@ -3,6 +3,7 @@ import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-regi
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import type { SimCfnTemplate } from "../../template/sim-cfn-template.js";
 import type { SimCfnStackResourceOperations } from "../sim-cfn-stack-resource-operations.js";
+import { SimCfnStackUpdatePlan } from "./sim-cfn-stack-update-plan.js";
 /**
  * What CloudFormation answers an update that would change nothing.
  *
@@ -34,8 +35,9 @@ interface SimCfnStackUpdaterProperties {
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.
  */
 export declare class SimCfnStackUpdater {
+    /** What the update does to the Stack's Resources. */
+    readonly plan: SimCfnStackUpdatePlan;
     private readonly properties;
-    private readonly plan;
     constructor(properties: SimCfnStackUpdaterProperties);
     /**
      * Refuse an update that would do nothing, the way CloudFormation refuses one.

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.js

@@ -25,8 +25,9 @@ export const simCfnNoUpdatesMessage = "No updates are to be performed.";
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.
  */
 export class SimCfnStackUpdater {
-    properties;
+    /** What the update does to the Stack's Resources. */
     plan;
+    properties;
     constructor(properties) {
         const { accountRegionScope, background, resources, updated } = properties;
         this.properties = properties;

package/dist/service/stepfunctions/command/execution/sim-states-execution-start.js

@@ -56,6 +56,7 @@ export class SimStatesExecutionStart {
             background: this.#background,
             tasks: this.#tasks,
             roleArn: stateMachine.roleArn,
+            stateMachineArn: stateMachine.arn,
         })({
             definition: stateMachine.parsedDefinition,
             record: execution,

package/dist/service/stepfunctions/execution/sim-states-run-task.js

@@ -14,6 +14,7 @@ export async function runSimStatesTask(state, input, context) {
         target: state.target,
         payload: simStatesEffectiveInput(input, state, context.contextObject),
         roleArn: context.roleArn,
+        stateMachineArn: context.stateMachineArn,
     });
     const output = simStatesEffectiveOutput(input, result, state, context.contextObject);
     return state.Next === undefined

package/dist/service/stepfunctions/execution/sim-states-state-outcome.d.ts

@@ -71,6 +71,7 @@ export interface SimStatesWalkContext {
      * The state machine's execution role, which a task assumes.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
     /**
      * What the walk is recording itself on, which a `Parallel` state's branch
      * hangs off.

package/dist/service/stepfunctions/execution/sim-states-walks.d.ts

@@ -11,6 +11,7 @@ interface SimStatesWalksProperties {
      * The state machine's execution role, which a task assumes.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
 }
 /**
  * How one execution walks a set of states, its `Parallel` branches included.

package/dist/service/stepfunctions/execution/sim-states-walks.js

@@ -16,6 +16,7 @@ export function simStatesWalks(properties) {
             contextObject: child.contextObject,
             tasks: properties.tasks,
             roleArn: properties.roleArn,
+            stateMachineArn: properties.stateMachineArn,
             walkChild: walks,
         },
         ...(child.onSettled !== undefined && { onSettled: child.onSettled }),

package/dist/service/stepfunctions/task/sim-aws-states-task-targets.js

@@ -30,7 +30,12 @@ export class SimAwsStatesTaskTargets {
         const { stateName, target } = invocation;
         const role = simStatesExecutionRoleTarget(invocation.roleArn, stateName);
         const roleScope = this.#simAws.accountRegionScope(role.accountId, this.#accountRegionScope.regionName);
-        const caller = await assumeSimStatesExecutionRole(role, roleScope);
+        // Step Functions supplies the state machine as the trust policy source.
+        // https://docs.aws.amazon.com/step-functions/latest/dg/procedure-create-iam-role.html
+        const caller = await assumeSimStatesExecutionRole(role, roleScope, {
+            arn: invocation.stateMachineArn,
+            accountId: this.#accountRegionScope.accountId,
+        });
         return await target.run({
             stateName,
             payload: invocation.payload,

package/dist/service/stepfunctions/task/sim-states-execution-role.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
 import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
+import type { SimServiceRoleSource } from "../../sts/service-role/sim-service-role-source.js";
 /**
  * The service principal a state machine's execution role trusts.
  */
@@ -21,4 +22,4 @@ export declare function simStatesExecutionRoleTarget(roleArn: string, stateName:
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer): Promise<SimAwsCaller>;
+export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer, source: SimServiceRoleSource): Promise<SimAwsCaller>;

package/dist/service/stepfunctions/task/sim-states-execution-role.js

@@ -46,12 +46,13 @@ const refusals = {
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export async function assumeSimStatesExecutionRole(target, scope) {
+export async function assumeSimStatesExecutionRole(target, scope, source) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simStatesServicePrincipal,
         sessionName,
         scope,
         refusals,
+        source,
     });
 }

package/dist/service/stepfunctions/task/sim-states-task-invocation.d.ts

@@ -15,6 +15,7 @@ export interface SimStatesTaskInvocation {
      * work.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
 }
 /**
  * Where a `Task` state's work is done.

package/docs/services/cloudformation/README.md

@@ -2165,6 +2165,100 @@ console.log(stacks.size);
 See [simulated IAM](https://yulinsim.dev/services/iam/ "Simulated IAM usage docs") for the documents
 it takes.
 
+### The read calls an update makes
+
+CloudFormation calls a resource's read handler when it needs the resource's attributes and holds no
+fresh copy of them. A stack update that leaves a resource unchanged, while the new template reads one
+of its attributes through `Fn::GetAtt` or `Fn::Sub`, is one such case. The handler runs as the
+stack's execution role. Yulin authorizes each of its calls as the deployment's principal, after the
+update's own changes and before its outputs are resolved. A denied call fails the update, which is
+rolled back.
+
+The calls come from the resource type's entry in the CloudFormation registry. Yulin keeps the ones in
+the type's own service and authorizes them on the resource's ARN, built from the stack's account and
+Region and the resource's properties. A resource yulin skips is authorized the same way, since the
+snapshot and the properties are all this takes. A call IAM scopes to no resource type is
+authorized on `*`.
+
+```typescript sim-cloudformation-read-handler
+/**
+ * An update refused because the deploy Role may not read an unchanged
+ * resource whose attribute an output reads.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws({
+  defaultAccountId: "123456789012",
+  defaultRegionName: "eu-west-2",
+});
+
+const deployer = await simAws.iam().makeDeployRole({
+  roleName: "cdk-exec",
+  policyDocument: {
+    Version: "2012-10-17",
+    Statement: {
+      Effect: "Allow",
+      Action: [
+        "s3:*",
+        "codeartifact:CreateDomain",
+        "codeartifact:CreateRepository",
+        "codeartifact:DescribeRepository",
+        "codeartifact:ListTagsForResource",
+      ],
+      Resource: "*",
+    },
+  },
+});
+
+const mirror = {
+  Domain: {
+    Type: "AWS::CodeArtifact::Domain",
+    Properties: { DomainName: "example" },
+  },
+  Repository: {
+    Type: "AWS::CodeArtifact::Repository",
+    Properties: { DomainName: "example", RepositoryName: "npm" },
+    DependsOn: "Domain",
+  },
+};
+const outputs = {
+  RepositoryArn: { Value: { "Fn::GetAtt": ["Repository", "Arn"] } },
+};
+
+const cloudFormation = simAws.cloudFormation();
+
+await cloudFormation.deployTemplate({
+  stackName: "artifacts",
+  template: { Resources: mirror, Outputs: outputs },
+  caller: deployer,
+});
+
+await cloudFormation.updateStack({
+  input: {
+    StackName: "artifacts",
+    TemplateBody: JSON.stringify({
+      Resources: { ...mirror, Sources: { Type: "AWS::S3::Bucket" } },
+      Outputs: outputs,
+    }),
+  },
+});
+
+try {
+  await cloudFormation.waitForStackUpdateComplete("artifacts");
+} catch (error) {
+  // "... is not authorized to perform:
+  // codeartifact:GetRepositoryPermissionsPolicy on resource:
+  // arn:aws:codeartifact:eu-west-2:123456789012:repository/example/npm"
+  console.log((error as Error).message);
+}
+```
+
+A resource the update creates or changes needs no read, because its own handler returned its
+attributes. A resource whose ARN cannot be built fails the update with the ARN variable it was
+missing. That happens to a resource yulin skips whose ARN holds an identifier its service would have
+generated, since only a created resource can give one.
+
 ### One caller for an assembly, and one per Stack
 
 `deployCdkOut(...)` takes a caller for every Stack in the assembly. A Stack deployed by a different
@@ -4579,4 +4673,16 @@ Each service's own docs describe what its resource types support.
   `InvokeRole` and `AddDefaultAuthorizerToCorsPreflight` fail the transform by name.
   `AutoPublishAlias` and `DeploymentPreference` are left out, because the simulator has one version
   of a function and nothing to shift traffic between.
+- A stack update authorizes the read handler calls of an unchanged resource whose attributes the
+  new template reads, and no other handler calls. The create, update and delete calls are the ones
+  each service makes itself. Creating a resource of a type yulin skips authorizes nothing. Of the read
+  calls, only those in the resource type's own service are authorized. The registry also lists calls
+  into other services (a KMS key, a role a property names), and a handler makes those only when a
+  property leads to them. See [the read calls an update makes](#the-read-calls-an-update-makes).
+- The read handler calls come from a snapshot of the registry and the Service Authorization
+  Reference, which `pnpm run cfn:read-handlers` refreshes. A resource type the snapshot leaves out is
+  not authorized at all. It leaves out a type whose read handler is unpublished, and one with no
+  resource type in the Service Authorization Reference named after it.
+- An `Fn::GetAtt` inside an `Fn::If` branch the conditions rule out still counts as reading the
+  resource.
 - Many advanced CloudFormation features are outside the simulation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.33",
+  "version": "1.22.0",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -15,6 +15,7 @@
     "build": "pnpm clean && tsc -p tsconfig.build.json && pnpm oxlint:config && pnpm docs:index",
     "oxlint:config": "pnpm tsx scripts/mts/write-oxlint-config.mts",
     "docs:index": "pnpm tsx scripts/mts/write-llms-index.mts",
+    "cfn:read-handlers": "pnpm tsx scripts/mts/write-cfn-read-handlers.mts",
     "build:check": "tsc -p tsconfig.json --noEmit",
     "prepack": "pnpm build",
     "verify:pack": "pnpm tsx scripts/mts/verify-pack.mts",
@@ -290,16 +291,16 @@
     "conventional-changelog-conventionalcommits": "9.3.1",
     "esbuild": "^0.28.2",
     "eslint": "^10.8.0",
-    "eslint-plugin-jsdoc": "^64.0.1",
+    "eslint-plugin-jsdoc": "^65.0.0",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
     "eslint-plugin-unicorn": "^76.0.0",
     "execa": "^10.0.0",
     "fta-cli": "^3.0.0",
     "hyparquet": "^1.29.2",
-    "hyparquet-writer": "^0.16.9",
+    "hyparquet-writer": "^0.17.0",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.73.0",
+    "oxfmt": "^0.74.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",