@kensio/yulin 1.21.4 → 1.21.5

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.d.ts

@@ -8,12 +8,16 @@ interface SimCdkAssetsPublisherProperties {
     readonly stackName?: string | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     /**
-     * The principal the deployment runs as, which the staging Bucket is created
-     * and written to as. A real `cdk deploy` publishes assets before
-     * CloudFormation sees the template, and it publishes them as somebody; a
-     * deployment that names a caller is what says who.
+     * The principal the assets are published as.
+     *
+     * A real `cdk deploy` publishes assets before CloudFormation sees the
+     * template, as the file publishing Role the assets manifest names in each
+     * destination's `assumeRoleArn`. CloudFormation then processes the template
+     * as the execution Role. A deployment that names an assets caller is what
+     * tells the two apart here, and one that names none publishes as whoever
+     * deploys.
      */
-    readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
 }
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
@@ -25,7 +29,7 @@ interface SimCdkAssetsPublisherProperties {
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,15 +46,16 @@ export declare class SimCdkAssetsPublisher {
     publish(): Promise<void>;
     private publishAsset;
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
     private ensureBucket;
     private stagingS3;

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.js

@@ -1,7 +1,7 @@
 import { SimCfnPseudoParameters } from "../../parameters/pseudo/sim-cfn-pseudo-parameters.js";
 import { SimCdkAssetPublications, } from "./sim-cdk-asset-publications.js";
 import { readSimCdkAssetBytes } from "./sim-cdk-asset-bytes.js";
-import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-resource-caller-options.js";
+import { simCfnResourceCallerOptions } from "../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
  *
@@ -12,7 +12,7 @@ import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-reso
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,7 +42,7 @@ export class SimCdkAssetsPublisher {
             }),
         }).resolve(cdkOutContext.assetsManifest);
         for (const publication of publications) {
-            // oxlint-disable-next-line no-await-in-loop -- assets sharing a staging Bucket must not race to create it
+            // oxlint-disable-next-line no-await-in-loop -- published in manifest order, as cdk-assets publishes them
             await this.publishAsset(publication);
         }
     }
@@ -52,38 +52,30 @@ export class SimCdkAssetsPublisher {
             return;
         }
         const s3 = this.stagingS3();
-        const options = simCfnResourceCallerOptions(this.properties.caller);
-        await this.ensureBucket(s3, publication.bucketName, options);
+        this.ensureBucket(s3, publication.bucketName);
         await s3.putObject({
             input: {
                 Bucket: publication.bucketName,
                 Key: publication.objectKey,
                 Body: assetBytes,
             },
-        }, options);
+        }, simCfnResourceCallerOptions(this.properties.assetsCaller));
     }
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
-    async ensureBucket(s3, bucketName, options) {
-        if (s3.getSimBucketByName(bucketName) !== undefined) {
-            return;
-        }
-        try {
-            await s3.createBucket({ input: { Bucket: bucketName } }, options);
-        }
-        catch (error) {
-            if (s3.getSimBucketByName(bucketName) === undefined) {
-                throw error;
-            }
+    ensureBucket(s3, bucketName) {
+        if (s3.getSimBucketByName(bucketName) === undefined) {
+            s3.makeSimBucket(bucketName);
         }
     }
     stagingS3() {

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.d.ts

@@ -1,6 +1,7 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import { TemporaryDirectory } from "../../../util/filesystem/temporary-directory.js";
 import type { SimCfnTemplateValueRecord } from "../template/value/sim-cfn-template-value.js";
+import type { SimCdkAssetsManifest } from "./sim-cdk-out-context.js";
 /**
  * One synthesized Stack in a cloud assembly a test writes.
  */
@@ -25,9 +26,20 @@ export interface SimCdkCloudAssemblyStackInput {
     readonly resources?: SimCfnTemplateValueRecord | undefined;
     /** The template's Outputs, which a Stack sharing a value needs. */
     readonly outputs?: SimCfnTemplateValueRecord | undefined;
+    /**
+     * The assets manifest `cdk synth` writes beside the template, for a Stack
+     * that stages file assets. A Stack given none has no manifest file at all,
+     * which is what a Stack with nothing to stage synthesizes.
+     */
+    readonly assets?: SimCdkAssetsManifest | undefined;
 }
 export interface SimCdkCloudAssemblyInput {
     readonly stacks: readonly SimCdkCloudAssemblyStackInput[];
+    /**
+     * Staged asset files to write into the assembly, keyed by the path an assets
+     * manifest source names.
+     */
+    readonly assetFiles?: Record<string, string> | undefined;
 }
 /** The Bucket a Stack in a written assembly creates, unless it is given others. */
 export declare function assemblyStackBucketName(artifactId: string): string;

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.js

@@ -23,13 +23,19 @@ export function assemblyStackBucketName(artifactId) {
 export const simCdkCloudAssemblyFactory = new AsyncMappedFactory(() => ({ stacks: [{ artifactId: "SiteStack", regionName: "eu-west-2" }] }), async (input) => {
     const directory = new TemporaryDirectory();
     await directory.writeFile(["cdk.out", "manifest.json"], jsonStringify(assemblyManifest(input.stacks)));
-    await Promise.all(input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
-    // JSON.stringify drops an undefined value, so a Stack given no
-    // Outputs writes a template with none rather than a null one.
-    jsonStringify({
-        Resources: stackResources(stack),
-        Outputs: stack.outputs,
-    }))));
+    await Promise.all([
+        ...input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
+        // JSON.stringify drops an undefined value, so a Stack given no
+        // Outputs writes a template with none rather than a null one.
+        jsonStringify({
+            Resources: stackResources(stack),
+            Outputs: stack.outputs,
+        }))),
+        ...input.stacks
+            .filter((stack) => stack.assets !== undefined)
+            .map(async (stack) => directory.writeFile(["cdk.out", assetsFileName(stack)], jsonStringify(stack.assets))),
+        ...Object.entries(input.assetFiles ?? {}).map(async ([assetPath, content]) => directory.writeFile(["cdk.out", assetPath], content)),
+    ]);
     return directory;
 });
 function assemblyManifest(stacks) {
@@ -56,6 +62,9 @@ function assemblyManifest(stacks) {
 function templateFileName(stack) {
     return `${stack.artifactId}.template.json`;
 }
+function assetsFileName(stack) {
+    return `${stack.artifactId}.assets.json`;
+}
 function stackResources(stack) {
     return (stack.resources ?? {
         [`${stack.artifactId}Bucket`]: {

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -18,6 +18,8 @@ interface CreateStackCommandHandlerProperties {
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     /** The principal the Stack's Resources are created as. */
     readonly caller?: SimAwsCaller | undefined;
+    /** The principal the Stack's CDK file assets are published as. */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /** The order Resources with no dependency between them are started in. */
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly exports?: SimCfnExports | undefined;
@@ -35,6 +37,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly cdkOutContext;
     private readonly bindings;
     private readonly caller;
+    private readonly assetsCaller;
     private readonly resourceOrder;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -16,10 +16,11 @@ export class CreateStackCommandHandler {
     cdkOutContext;
     bindings;
     caller;
+    assetsCaller;
     resourceOrder;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, assetsCaller, resourceOrder, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
@@ -27,6 +28,7 @@ export class CreateStackCommandHandler {
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.assetsCaller = assetsCaller;
         this.resourceOrder = resourceOrder;
         this.exports = exports;
     }
@@ -65,6 +67,7 @@ export class CreateStackCommandHandler {
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
             caller: this.caller,
+            assetsCaller: this.assetsCaller,
             resourceOrder: this.resourceOrder,
             exports: this.exports,
         });

package/dist/service/cloudformation/command/update-stack/update-stack.handler.d.ts

@@ -22,6 +22,11 @@ interface UpdateStackCommandHandlerProperties {
      * one. Left out, the Stack goes on running as whoever deployed it.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal to publish the re-synthesized CDK file assets as, for an
+     * update that names one. Left out, they are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /** The export names published in this Account and Region. */
     readonly exports?: SimCfnExports | undefined;
 }
@@ -37,6 +42,7 @@ export declare class UpdateStackCommandHandler implements CommandHandler<SimUpda
     private readonly background;
     private readonly cdkOutContext;
     private readonly caller;
+    private readonly assetsCaller;
     private readonly exports;
     constructor(properties: UpdateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/update-stack/update-stack.handler.js

@@ -14,6 +14,7 @@ export class UpdateStackCommandHandler {
     background;
     cdkOutContext;
     caller;
+    assetsCaller;
     exports;
     constructor(properties) {
         this.simAws = properties.simAws;
@@ -22,6 +23,7 @@ export class UpdateStackCommandHandler {
         this.background = properties.background;
         this.cdkOutContext = properties.cdkOutContext;
         this.caller = properties.caller;
+        this.assetsCaller = properties.assetsCaller;
         this.exports = properties.exports;
     }
     /**
@@ -51,7 +53,11 @@ export class UpdateStackCommandHandler {
             stack,
             input: command.input,
             exports: this.exports,
-        }), { cdkOutContext: this.cdkOutContext, caller: this.caller });
+        }), {
+            cdkOutContext: this.cdkOutContext,
+            caller: this.caller,
+            assetsCaller: this.assetsCaller,
+        });
         return {
             StackId: stack.stackId,
             $metadata: {},

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, caller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, assetsCaller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -36,6 +36,7 @@ export class SimCfnCdkOutDeployer {
             stackName: stack.stackName,
             ...options,
             caller: caller ?? plan.caller,
+            assetsCaller: assetsCaller ?? plan.assetsCaller,
             resourceOrder: resourceOrder ?? plan.resourceOrder,
             transform: cdkOutBoundTransform(transform, deployed),
         });

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-options-deployed.d.ts

@@ -0,0 +1,10 @@
+import type { SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
+import type { SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+/**
+ * Refuse options keyed against a Stack that is not being deployed.
+ *
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
+ */
+export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-options-deployed.js

@@ -0,0 +1,14 @@
+/**
+ * Refuse options keyed against a Stack that is not being deployed.
+ *
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
+ */
+export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
+    const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
+    const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
+    if (unmatched.length > 0) {
+        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
+    }
+}

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -1,7 +1,7 @@
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
-import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+import type { SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
 import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployCdkOutProperties {
     /** The `cdk.out` directory to deploy, holding a `manifest.json`. */
@@ -23,6 +23,15 @@ export interface SimCloudFormationDeployCdkOutProperties {
      * in `stackOptions` overrides for its own Stack.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal every Stack in the assembly publishes its CDK file assets
+     * as, which one named in `stackOptions` overrides for its own Stack.
+     *
+     * A real `cdk deploy` publishes assets as the file publishing Role and
+     * processes each template as the execution Role. Left out, an assembly
+     * publishes its assets as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order every Stack in the assembly creates Resources with no dependency
      * between them in, which one named in `stackOptions` overrides for its own
@@ -43,6 +52,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
     readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import { loadCdkAssemblyStacks, } from "../cdk/sim-cdk-assembly-manifest.js";
 import { orderCdkAssemblyStacks } from "../cdk/sim-cdk-assembly-order.js";
 import { selectCdkAssemblyStacks } from "../cdk/sim-cdk-assembly-selection.js";
-import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options.js";
+import { assertCdkOutOptionsAreDeployed } from "./sim-cfn-cdk-out-options-deployed.js";
 /**
  * Work out which Stacks to deploy, in what order, and into which region.
  *
@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, caller, resourceOrder, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, assetsCaller, resourceOrder, stackOptions, } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -23,6 +23,7 @@ export async function planCdkOutDeployment(properties) {
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
         caller,
+        assetsCaller,
         resourceOrder,
         stackOptions,
     };

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -34,6 +34,11 @@ export interface SimCfnCdkOutStackOptions {
      * application Stack deployed by another is what this is for.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal this Stack publishes its CDK file assets as, where the
+     * assembly's own assets caller is not the right one for it.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order this Stack creates Resources with no dependency between them in,
      * where the assembly's own order is not the right one for it.
@@ -53,11 +58,3 @@ export declare function cdkOutOptionsFor(stack: SimCdkAssemblyStack, optionsByNa
  * keeps the deployment it was handed while the call goes on deploying.
  */
 export declare function cdkOutBoundTransform(transform: SimCfnCdkOutTemplateTransform | undefined, deployed: ReadonlyMap<string, SimCfnDeployedStack>): SimCfnTemplateFileTransform | undefined;
-/**
- * Refuse options keyed against a Stack that is not being deployed.
- *
- * A renamed Stack would otherwise take its bindings, its caller and its
- * transform with it without saying anything, and the deployment that lost them
- * looks like one that never had them.
- */
-export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.js

@@ -17,17 +17,3 @@ export function cdkOutBoundTransform(transform, deployed) {
     const deployedSoFar = new Map(deployed);
     return (template) => transform(template, deployedSoFar);
 }
-/**
- * Refuse options keyed against a Stack that is not being deployed.
- *
- * A renamed Stack would otherwise take its bindings, its caller and its
- * transform with it without saying anything, and the deployment that lost them
- * looks like one that never had them.
- */
-export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
-    const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
-    const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
-    if (unmatched.length > 0) {
-        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
-    }
-}

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -24,6 +24,15 @@ export interface SimCloudFormationCreateStackProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are created in.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -59,6 +59,7 @@ export class SimCloudFormationTemplateDeployer {
             parameters: properties.parameters,
             bindings: properties.bindings,
             caller: properties.caller,
+            assetsCaller: properties.assetsCaller,
             resourceOrder: properties.resourceOrder,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
@@ -118,6 +119,7 @@ export class SimCloudFormationTemplateDeployer {
             cdkOutContext: deployment.cdkOutContext,
             bindings: deployment.bindings,
             caller: deployment.caller,
+            assetsCaller: deployment.assetsCaller,
             resourceOrder: deployment.resourceOrder,
             exports: this.exports,
         });

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -20,6 +20,15 @@ export interface SimCloudFormationDeployTemplateFileProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are created in.
      *
@@ -64,6 +73,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings, caller, resourceOrder } = deployment;
+        const { templatePath, parameters, bindings, caller, assetsCaller, resourceOrder, } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -32,6 +32,7 @@ export class SimCfnTemplateFileLoader {
             parameters,
             bindings,
             caller,
+            assetsCaller,
             resourceOrder,
             cdkOutContext,
         };

package/dist/service/cloudformation/deploy/sim-cfn-template-file-updater.js

@@ -43,6 +43,7 @@ export class SimCfnTemplateFileUpdater {
             background: this.background,
             cdkOutContext: loaded.cdkOutContext,
             caller: loaded.caller,
+            assetsCaller: loaded.assetsCaller,
         });
         await handler.handle({
             input: {

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.d.ts

@@ -0,0 +1,47 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
+/**
+ * What an update can replace on a Stack's deploy context. Anything it leaves
+ * out, the Stack goes on using.
+ */
+export interface SimCfnStackUpdateContext {
+    readonly cdkOutContext?: SimCdkOutContext | undefined;
+    readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
+}
+/**
+ * What a Stack is deploying from, and who it is deploying as.
+ *
+ * These three travel together and are the only things an update replaces, so
+ * they are held apart from the rest of a Stack's Resource operations. An
+ * operation reads them here whenever it runs, rather than closing over the
+ * values the deployment started with.
+ */
+export declare class SimCfnStackDeployContext {
+    /** The CDK cloud assembly the Stack's template was synthesized into. */
+    cdkOutContext: SimCdkOutContext | undefined;
+    /** The principal the Stack's Resource work is authorized as. */
+    caller: SimAwsCaller | undefined;
+    /** The principal the Stack's CDK file assets are published as. */
+    assetsCaller: SimAwsCaller | undefined;
+    constructor(properties: SimCfnStackUpdateContext);
+    /**
+     * Take on what an update brings with it, for this and every later operation.
+     *
+     * A synthesis writes the template and the assets manifest beside it together,
+     * so a Stack updated from a re-synthesized template needs the manifest that
+     * came with it. Keeping the one the Stack was deployed from would look up the
+     * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
+     */
+    useUpdate(properties: SimCfnStackUpdateContext): void;
+    /**
+     * The principal file assets are published as, which is the deployment's own
+     * caller unless the deployment named one for publishing.
+     */
+    publishingCaller(): SimAwsCaller | undefined;
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.js

@@ -0,0 +1,46 @@
+/**
+ * What a Stack is deploying from, and who it is deploying as.
+ *
+ * These three travel together and are the only things an update replaces, so
+ * they are held apart from the rest of a Stack's Resource operations. An
+ * operation reads them here whenever it runs, rather than closing over the
+ * values the deployment started with.
+ */
+export class SimCfnStackDeployContext {
+    /** The CDK cloud assembly the Stack's template was synthesized into. */
+    cdkOutContext;
+    /** The principal the Stack's Resource work is authorized as. */
+    caller;
+    /** The principal the Stack's CDK file assets are published as. */
+    assetsCaller;
+    constructor(properties) {
+        this.cdkOutContext = properties.cdkOutContext;
+        this.caller = properties.caller;
+        this.assetsCaller = properties.assetsCaller;
+    }
+    /**
+     * Take on what an update brings with it, for this and every later operation.
+     *
+     * A synthesis writes the template and the assets manifest beside it together,
+     * so a Stack updated from a re-synthesized template needs the manifest that
+     * came with it. Keeping the one the Stack was deployed from would look up the
+     * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
+     */
+    useUpdate(properties) {
+        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
+        this.caller = properties.caller ?? this.caller;
+        this.assetsCaller = properties.assetsCaller ?? this.assetsCaller;
+    }
+    /**
+     * The principal file assets are published as, which is the deployment's own
+     * caller unless the deployment named one for publishing.
+     */
+    publishingCaller() {
+        return this.assetsCaller ?? this.caller;
+    }
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
+import { type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
 import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
@@ -28,6 +29,11 @@ interface SimCfnStackResourceOperationsProperties {
      * caller leaves each service to decide the request as the Account root.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the Stack's CDK file assets are published as, where that is
+     * somebody other than the caller its Resources are created as.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are started in.
      */
@@ -52,8 +58,7 @@ export declare class SimCfnStackResourceOperations {
     private readonly stackName;
     private readonly bindings;
     private readonly resourceOrder;
-    private cdkOutContext;
-    private caller;
+    private readonly context;
     /**
      * Resources an update kept in simulated AWS.
      *
@@ -64,23 +69,8 @@ export declare class SimCfnStackResourceOperations {
      */
     private readonly retainedByUpdates;
     constructor(properties: SimCfnStackResourceOperationsProperties);
-    /**
-     * Take on what an update brings with it, for this and every later operation.
-     *
-     * A synthesis writes the template and the assets manifest beside it together,
-     * so a Stack updated from a re-synthesized template needs the manifest that
-     * came with it. Keeping the one the Stack was deployed from would look up the
-     * asset a replaced Resource names in a manifest written before it existed.
-     *
-     * An update naming a caller runs as that one, and the Stack is torn down as
-     * it afterwards. An update that names none keeps the deployment's caller, so
-     * a Stack updated from a plain template path goes on running as whoever
-     * deployed it.
-     */
-    useUpdate(properties: {
-        readonly cdkOutContext?: SimCdkOutContext | undefined;
-        readonly caller?: SimAwsCaller | undefined;
-    }): void;
+    /** Take on what an update brings with it, for every later operation. */
+    useUpdate(properties: SimCfnStackUpdateContext): void;
     /**
      * Create every Resource in the given Stack Resource map.
      */

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -1,3 +1,4 @@
+import { SimCfnStackDeployContext, } from "./sim-cfn-stack-deploy-context.js";
 import { SimCdkAssetsPublisher } from "../cdk/assets/sim-cdk-assets-publisher.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import { simCfnStackRetainedLogicalIds } from "./teardown/sim-cfn-stack-retained-logical-ids.js";
@@ -24,8 +25,7 @@ export class SimCfnStackResourceOperations {
     stackName;
     bindings;
     resourceOrder;
-    cdkOutContext;
-    caller;
+    context;
     /**
      * Resources an update kept in simulated AWS.
      *
@@ -36,31 +36,17 @@ export class SimCfnStackResourceOperations {
      */
     retainedByUpdates = [];
     constructor(properties) {
-        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, resourceOrder, } = properties;
+        const { simAws, accountRegionScope, stackName, bindings, resourceOrder } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stackName = stackName;
-        this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
-        this.caller = caller;
         this.resourceOrder = resourceOrder;
+        this.context = new SimCfnStackDeployContext(properties);
     }
-    /**
-     * Take on what an update brings with it, for this and every later operation.
-     *
-     * A synthesis writes the template and the assets manifest beside it together,
-     * so a Stack updated from a re-synthesized template needs the manifest that
-     * came with it. Keeping the one the Stack was deployed from would look up the
-     * asset a replaced Resource names in a manifest written before it existed.
-     *
-     * An update naming a caller runs as that one, and the Stack is torn down as
-     * it afterwards. An update that names none keeps the deployment's caller, so
-     * a Stack updated from a plain template path goes on running as whoever
-     * deployed it.
-     */
+    /** Take on what an update brings with it, for every later operation. */
     useUpdate(properties) {
-        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
-        this.caller = properties.caller ?? this.caller;
+        this.context.useUpdate(properties);
     }
     /**
      * Create every Resource in the given Stack Resource map.
@@ -120,7 +106,7 @@ export class SimCfnStackResourceOperations {
                 simAws: this.simAws,
                 currentResources,
                 updatedResources,
-                caller: this.caller,
+                caller: this.context.caller,
             });
         }));
     }
@@ -173,8 +159,8 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
             stackName: this.stackName,
-            cdkOutContext: this.cdkOutContext,
-            caller: this.caller,
+            cdkOutContext: this.context.cdkOutContext,
+            assetsCaller: this.context.publishingCaller(),
         }).publish();
     }
     creator(resources) {
@@ -182,9 +168,9 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
-            cdkOutContext: this.cdkOutContext,
+            cdkOutContext: this.context.cdkOutContext,
             bindings: this.bindings,
-            caller: this.caller,
+            caller: this.context.caller,
             resourceOrder: this.resourceOrder,
         });
     }
@@ -193,7 +179,7 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
-            caller: this.caller,
+            caller: this.context.caller,
             retention,
         });
     }

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -38,7 +38,7 @@ export class SimCfnStack {
     stackOutputs;
     cfnTemplate;
     constructor(properties) {
-        const { simAws, accountRegionScope, background, stackName, stackId, template, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
+        const { simAws, accountRegionScope, background, stackName, stackId, template, cdkOutContext, bindings, caller, assetsCaller, resourceOrder, exports, } = properties;
         this.background = background;
         this.stackName = stackName;
         this.stackId = stackId;
@@ -61,6 +61,7 @@ export class SimCfnStack {
             cdkOutContext,
             bindings,
             caller,
+            assetsCaller,
             resourceOrder,
         });
         this.lifecycle = new SimCfnStackDeploymentLifecycle({

package/dist/service/cloudformation/stack/sim-cfn-stack.type.d.ts

@@ -24,6 +24,11 @@ export interface SimCfnStackUpdateProperties {
      * The Stack goes on using it, as it does the cloud assembly.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal to publish the re-synthesized file assets as, for an update
+     * that names one. The Stack goes on using it too.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationStackProperties {
     readonly simAws: SimAws;
@@ -44,6 +49,15 @@ export interface SimCloudFormationStackProperties {
      * simulation.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order this Stack starts Resources with no dependency between them in.
      * The template's own order unless the deployment asked for another one.

package/dist/service/s3/bucket/sim-s3-bucket-maker.d.ts

@@ -0,0 +1,31 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimS3Bucket, type SimS3BucketName } from "./sim-s3-bucket.js";
+import type { SimS3GlobalRegistry } from "../sim-s3-global-registry.js";
+interface SimS3BucketMakerProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly s3GlobalRegistry: SimS3GlobalRegistry;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export declare class SimS3BucketMaker {
+    private readonly properties;
+    constructor(properties: SimS3BucketMakerProperties);
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName: string): SimS3Bucket;
+}
+export {};

package/dist/service/s3/bucket/sim-s3-bucket-maker.js

@@ -0,0 +1,41 @@
+import { SimS3BucketNameAvailability } from "./name-availability/sim-s3-bucket-name-availability.js";
+import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
+import { SimS3Bucket } from "./sim-s3-bucket.js";
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export class SimS3BucketMaker {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName) {
+        const { accountRegionScope, buckets, s3GlobalRegistry, background } = this.properties;
+        validateS3BucketName(bucketName);
+        new SimS3BucketNameAvailability({
+            accountRegionScope,
+            buckets,
+            s3GlobalRegistry,
+        }).ensureCanCreateBucketNamed(bucketName);
+        const bucket = new SimS3Bucket({
+            bucketName,
+            accountRegionScope,
+            clock: background,
+        });
+        buckets.set(bucketName, bucket);
+        s3GlobalRegistry.registerBucket(bucketName, accountRegionScope);
+        return bucket;
+    }
+}

package/dist/service/s3/command/create-bucket/create-bucket.handler.d.ts

@@ -1,6 +1,6 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimCreateBucketCommand, SimCreateBucketCommandOutput } from "./create-bucket.command.js";
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3GlobalRegistry } from "../../sim-s3-global-registry.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
@@ -8,7 +8,7 @@ import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-int
 import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
 interface CreateBucketCommandHandlerProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
-    readonly buckets: Map<string, SimS3Bucket>;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
     readonly s3GlobalRegistry: SimS3GlobalRegistry;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;

package/dist/service/s3/command/create-bucket/create-bucket.handler.js

@@ -1,7 +1,6 @@
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimS3BucketNameAvailability } from "../../bucket/name-availability/sim-s3-bucket-name-availability.js";
+import { SimS3BucketMaker } from "../../bucket/sim-s3-bucket-maker.js";
 import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
@@ -49,19 +48,12 @@ export class CreateBucketCommandHandler {
                 resource,
             });
         }
-        const simS3BucketNameAvailability = new SimS3BucketNameAvailability({
+        new SimS3BucketMaker({
             accountRegionScope: this.accountRegionScope,
             buckets: this.buckets,
             s3GlobalRegistry: this.s3GlobalRegistry,
-        });
-        simS3BucketNameAvailability.ensureCanCreateBucketNamed(bucketName);
-        const bucket = new SimS3Bucket({
-            bucketName,
-            accountRegionScope: this.accountRegionScope,
-            clock: this.background,
-        });
-        this.buckets.set(bucketName, bucket);
-        this.s3GlobalRegistry.registerBucket(bucketName, this.accountRegionScope);
+            background: this.background,
+        }).make(bucketName);
         return {
             BucketArn: resource,
             Location: `/${bucketName}`,

package/dist/service/s3/sim-s3-commands.d.ts

@@ -63,6 +63,12 @@ export declare class SimS3Commands {
     readonly objectTagging: SimS3ObjectTaggingCommands;
     readonly multipartUploads: SimS3MultipartCommands;
     readonly objectNotifier: SimS3ObjectNotifier;
+    /**
+     * The scheduler and clock every command area here shares, which a
+     * simulator-only control on the service facade needs to hand a Bucket it
+     * makes outside the commands.
+     */
+    readonly background: BackgroundScheduler;
     constructor(properties: SimS3CommandsProperties);
 }
 export {};

package/dist/service/s3/sim-s3-commands.js

@@ -35,8 +35,15 @@ export class SimS3Commands {
     objectTagging;
     multipartUploads;
     objectNotifier;
+    /**
+     * The scheduler and clock every command area here shares, which a
+     * simulator-only control on the service facade needs to hand a Bucket it
+     * makes outside the commands.
+     */
+    background;
     constructor(properties) {
         const { background = new BackgroundTasks(), notificationDestinations = new SimS3NoNotificationDestinations(), } = properties;
+        this.background = background;
         const iam = simIamInRegion(properties.iam, properties.accountRegionScope.regionName);
         this.objectNotifier = new SimS3ObjectNotifier({
             destinations: notificationDestinations,

package/dist/service/s3/sim-s3.d.ts

@@ -18,9 +18,25 @@ import type { SimS3MountFilesystemOptions } from "./mount/sim-s3-mount.type.js";
  */
 export declare class SimS3 extends SimS3Operations {
     private readonly bucketAccess;
+    private readonly bucketMaker;
     private readonly cfnFactory;
     private readonly sdkRouter;
     constructor(properties?: SimS3Properties);
+    /**
+     * Make a Bucket in this scope without a `CreateBucketCommand`, and so
+     * without a principal to authorize.
+     *
+     * This is for a Bucket real AWS has provisioned before the code under test
+     * runs, which nothing in the simulation is deploying. The CDK bootstrap
+     * staging Bucket is the one the simulator makes for itself: `cdk deploy`
+     * publishes assets into a Bucket the bootstrap stack created, and a
+     * deployment that had to create it would be charged permissions no real
+     * deployment needs.
+     *
+     * A name this scope cannot take is reported the way `CreateBucketCommand`
+     * reports it.
+     */
+    makeSimBucket(bucketName: SimS3BucketName | string): SimS3Bucket;
     /**
      * Change how many keys one page of an Object listing holds, which real S3
      * fixes at a thousand.

package/dist/service/s3/sim-s3.js

@@ -1,5 +1,6 @@
 import { SimS3GlobalRegistry } from "./sim-s3-global-registry.js";
 import { SimS3BucketAccess } from "./bucket/sim-s3-bucket-access.js";
+import { SimS3BucketMaker } from "./bucket/sim-s3-bucket-maker.js";
 import { SimS3CloudFormationResourceFactory } from "./cfn/sim-cfn-s3-resource-factory.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimS3Commands } from "./sim-s3-commands.js";
@@ -16,6 +17,7 @@ import { SimS3SdkCommandRouter } from "./sdk/sim-s3-sdk-command-router.js";
  */
 export class SimS3 extends SimS3Operations {
     bucketAccess;
+    bucketMaker;
     cfnFactory = new SimS3CloudFormationResourceFactory(this);
     sdkRouter = new SimS3SdkCommandRouter(this);
     constructor(properties = {}) {
@@ -32,6 +34,29 @@ export class SimS3 extends SimS3Operations {
             accountRegionScope,
             s3GlobalRegistry,
         });
+        this.bucketMaker = new SimS3BucketMaker({
+            accountRegionScope,
+            buckets,
+            s3GlobalRegistry,
+            background: this.commands.background,
+        });
+    }
+    /**
+     * Make a Bucket in this scope without a `CreateBucketCommand`, and so
+     * without a principal to authorize.
+     *
+     * This is for a Bucket real AWS has provisioned before the code under test
+     * runs, which nothing in the simulation is deploying. The CDK bootstrap
+     * staging Bucket is the one the simulator makes for itself: `cdk deploy`
+     * publishes assets into a Bucket the bootstrap stack created, and a
+     * deployment that had to create it would be charged permissions no real
+     * deployment needs.
+     *
+     * A name this scope cannot take is reported the way `CreateBucketCommand`
+     * reports it.
+     */
+    makeSimBucket(bucketName) {
+        return this.bucketMaker.make(bucketName);
     }
     /**
      * Change how many keys one page of an Object listing holds, which real S3

package/docs/services/cloudformation/README.md

@@ -2115,8 +2115,62 @@ const stacks = await simAws.cloudFormation().deployCdkOut({
 console.log(stacks.get("PipelineStack")?.stackName);
 ```
 
-A staged CDK asset is published under the same principal, before CloudFormation reads the template
-that points at it.
+### The principal a CDK asset is published as
+
+A real `cdk deploy` runs in two phases under two Roles. `cdk-assets` publishes every staged file
+asset to the bootstrap staging bucket as the file publishing Role, and CloudFormation then processes
+the template as the execution Role. `assetsCaller` names the first of those, beside the `caller`
+naming the second.
+
+```typescript sim-cloudformation-assets-caller
+/**
+ * Publishing a Stack's CDK file assets as the file publishing Role.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws({
+  defaultAccountId: "123456789012",
+  defaultRegionName: "eu-west-2",
+});
+
+const publisher = await simAws.iam().makeDeployRole({
+  roleName: "cdk-file-publishing",
+  policyDocument: {
+    Version: "2012-10-17",
+    Statement: {
+      Effect: "Allow",
+      Action: ["s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:PutObject"],
+      Resource: "arn:aws:s3:::cdk-hnb659fds-assets-*",
+    },
+  },
+});
+
+const executor = await simAws.iam().makeDeployRole({
+  roleName: "cdk-exec",
+  policyDocument: {
+    Version: "2012-10-17",
+    Statement: { Effect: "Allow", Action: "s3:*", Resource: "*" },
+  },
+});
+
+const stacks = await simAws.cloudFormation().deployCdkOut({
+  directoryPath: "cdk.out",
+  caller: executor,
+  assetsCaller: publisher,
+});
+
+console.log(stacks.size);
+```
+
+`deployTemplate(...)` and `deployTemplateFile(...)` take the same option, and a Stack in an assembly
+names its own in `stackOptions`. A deployment that names no `assetsCaller` publishes its assets as
+`caller`, the way every deployment did before the two could be told apart.
+
+The CDK bootstrap stack provisions the staging bucket, long before either Role runs. Yulin stands in
+for that and makes the bucket outside IAM when the first asset is published into it. So a Role
+holding only what a scoped execution policy grants on `cdk-hnb659fds-assets-*` deploys a cloud
+assembly with file assets, with no `s3:CreateBucket` or `s3:PutObject` added to it.
 
 ## Editing a synthesized template before deploying it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.4",
+  "version": "1.21.5",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -293,7 +293,7 @@
     "eslint-plugin-jsdoc": "^63.3.2",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
-    "eslint-plugin-unicorn": "^72.0.0",
+    "eslint-plugin-unicorn": "^73.0.0",
     "execa": "^10.0.0",
     "fta-cli": "^3.0.0",
     "hyparquet": "^1.29.2",