@kensio/yulin 1.21.4 → 1.21.6

package/dist/service/cloudformation/resource/create/sim-cfn-resource-create-operation.js

@@ -1,6 +1,7 @@
 import { SimCfnResourceCreator } from "./sim-cfn-resource-creator.js";
 import { simCfnInertResourceReason } from "../inert/sim-cfn-inert-resource.js";
 import { isSimCfnUnsupportedResourceError } from "../unsupported/sim-cfn-unsupported-resource.js";
+import { simCfnSkippedPhysicalName } from "../unsupported/sim-cfn-named-skip.js";
 /**
  * Runs the asynchronous CloudFormation Resource creation lifecycle.
  *
@@ -63,8 +64,13 @@ export class SimCfnResourceCreateOperation {
      * a gap and is skipped, unless nothing this simulator models could have told
      * it apart from one that was created, in which case saying it is missing
      * sends a reader after something that is not lost.
+     *
+     * Either way the Resource keeps whatever name the refusal carried. A
+     * template reading a Ref of it then gets the name real CloudFormation would
+     * have produced.
      */
     recordUncreated(error, context) {
+        this.resource.recordUncreatedPhysicalName(simCfnSkippedPhysicalName(error));
         const inertReason = simCfnInertResourceReason(this.resource, context.resources);
         if (inertReason !== undefined) {
             this.resource.markCreateInert(inertReason);

package/dist/service/cloudformation/resource/sim-cfn-resource-record.d.ts

@@ -18,6 +18,7 @@ import type { SimCfnResourceResolveContext, SimCloudFormationResourceProperties
  * be calling.
  */
 export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgnorer {
+    #private;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly logicalId: string;
     /** The Stack this Resource belongs to, where a generated name comes from. */
@@ -32,6 +33,14 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * The simulated AWS object created for this CloudFormation Resource.
      */
     abstract get simResource(): object | undefined;
+    /**
+     * The name real CloudFormation would have given this Resource, where a
+     * service worked it out before refusing to create it.
+     *
+     * A Resource with a name behind it answers Ref with that name. The
+     * logical-ID stand-in is left for a Resource nothing ever named.
+     */
+    get uncreatedPhysicalName(): string | undefined;
     /**
      * The properties this Resource was created without acting on.
      */
@@ -97,6 +106,12 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * only thing that knows whether a property changes behaviour it simulates.
      */
     ignoreProperty(path: string, reason: string): void;
+    /**
+     * Record the name a service worked out for this Resource before refusing to
+     * create it. Called by the creation operation, which is where a refusal
+     * carrying a name is read.
+     */
+    recordUncreatedPhysicalName(physicalName: string | undefined): void;
     /**
      * The value returned when this Resource is referenced via Fn::GetAtt.
      *
@@ -132,5 +147,9 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * again.
      */
     protected clearIgnoredProperties(): void;
+    /**
+     * Forget the name a refusal recorded, for a Resource being created again.
+     */
+    protected clearUncreatedPhysicalName(): void;
     private cfnValueAdapter;
 }

package/dist/service/cloudformation/resource/sim-cfn-resource-record.js

@@ -25,6 +25,7 @@ export class SimCfnResourceRecord {
     /** The Stack this Resource belongs to, where a generated name comes from. */
     stackName;
     template;
+    #uncreatedPhysicalName;
     ignoredPropertyList = new SimCfnIgnoredProperties();
     resourceTemplateReader;
     propertyResolver;
@@ -54,6 +55,16 @@ export class SimCfnResourceRecord {
         });
         this.resourceLogicalIds = resourceLogicalIds;
     }
+    /**
+     * The name real CloudFormation would have given this Resource, where a
+     * service worked it out before refusing to create it.
+     *
+     * A Resource with a name behind it answers Ref with that name. The
+     * logical-ID stand-in is left for a Resource nothing ever named.
+     */
+    get uncreatedPhysicalName() {
+        return this.#uncreatedPhysicalName;
+    }
     /**
      * The properties this Resource was created without acting on.
      */
@@ -140,6 +151,14 @@ export class SimCfnResourceRecord {
     ignoreProperty(path, reason) {
         this.ignoredPropertyList.record(this, path, reason);
     }
+    /**
+     * Record the name a service worked out for this Resource before refusing to
+     * create it. Called by the creation operation, which is where a refusal
+     * carrying a name is read.
+     */
+    recordUncreatedPhysicalName(physicalName) {
+        this.#uncreatedPhysicalName = physicalName;
+    }
     /**
      * The value returned when this Resource is referenced via Fn::GetAtt.
      *
@@ -183,11 +202,18 @@ export class SimCfnResourceRecord {
     clearIgnoredProperties() {
         this.ignoredPropertyList.clear();
     }
+    /**
+     * Forget the name a refusal recorded, for a Resource being created again.
+     */
+    clearUncreatedPhysicalName() {
+        this.#uncreatedPhysicalName = undefined;
+    }
     cfnValueAdapter() {
         return simCfnResourceValueAdapter({
             logicalId: this.logicalId,
             type: this.type,
             simResource: this.simResource,
+            uncreatedPhysicalName: this.uncreatedPhysicalName,
         });
     }
 }

package/dist/service/cloudformation/resource/sim-cfn-resource.js

@@ -176,6 +176,7 @@ export class SimCfnResource extends SimCfnResourceRecord {
      */
     markCreateInProgress() {
         this.clearIgnoredProperties();
+        this.clearUncreatedPhysicalName();
         this.creationState.markCreateInProgress();
     }
     /**

package/dist/service/cloudformation/resource/unsupported/sim-cfn-named-skip.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A refusal from a service that had already worked out the name real
+ * CloudFormation would give the Resource.
+ *
+ * The logical ID a skipped Resource answers `Ref` with stands in for a value
+ * the simulation does not hold. Where a service names a Resource before
+ * refusing it, the simulation does hold one, so raising this carries the name
+ * through the refusal and the Resource answers `Ref` with it. Sim Lambda
+ * declining a function on its Runtime is the case that needs it: CDK writes a
+ * log group name as `/aws/lambda/` joined to a `Ref` of the function, and a
+ * logical ID there produces a log group under a name no account would hold.
+ *
+ * Nothing else about the refusal changes. The message still decides whether
+ * the Stack records a skip or fails. A service raising this says "Unsupported
+ * sim ... CloudFormation" as it would in an ordinary Error.
+ */
+export declare class SimCfnNamedSkip extends Error {
+    readonly physicalName: string;
+    readonly name = "SimCfnNamedSkip";
+    constructor(message: string, physicalName: string);
+}
+/**
+ * The name a refusal carries, or nothing where the service had not named the
+ * Resource before refusing it.
+ */
+export declare function simCfnSkippedPhysicalName(error: unknown): string | undefined;

package/dist/service/cloudformation/resource/unsupported/sim-cfn-named-skip.js

@@ -0,0 +1,31 @@
+/**
+ * A refusal from a service that had already worked out the name real
+ * CloudFormation would give the Resource.
+ *
+ * The logical ID a skipped Resource answers `Ref` with stands in for a value
+ * the simulation does not hold. Where a service names a Resource before
+ * refusing it, the simulation does hold one, so raising this carries the name
+ * through the refusal and the Resource answers `Ref` with it. Sim Lambda
+ * declining a function on its Runtime is the case that needs it: CDK writes a
+ * log group name as `/aws/lambda/` joined to a `Ref` of the function, and a
+ * logical ID there produces a log group under a name no account would hold.
+ *
+ * Nothing else about the refusal changes. The message still decides whether
+ * the Stack records a skip or fails. A service raising this says "Unsupported
+ * sim ... CloudFormation" as it would in an ordinary Error.
+ */
+export class SimCfnNamedSkip extends Error {
+    physicalName;
+    name = "SimCfnNamedSkip";
+    constructor(message, physicalName) {
+        super(message);
+        this.physicalName = physicalName;
+    }
+}
+/**
+ * The name a refusal carries, or nothing where the service had not named the
+ * Resource before refusing it.
+ */
+export function simCfnSkippedPhysicalName(error) {
+    return error instanceof SimCfnNamedSkip ? error.physicalName : undefined;
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.d.ts

@@ -0,0 +1,47 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
+/**
+ * What an update can replace on a Stack's deploy context. Anything it leaves
+ * out, the Stack goes on using.
+ */
+export interface SimCfnStackUpdateContext {
+    readonly cdkOutContext?: SimCdkOutContext | undefined;
+    readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
+}
+/**
+ * What a Stack is deploying from, and who it is deploying as.
+ *
+ * These three travel together and are the only things an update replaces, so
+ * they are held apart from the rest of a Stack's Resource operations. An
+ * operation reads them here whenever it runs, rather than closing over the
+ * values the deployment started with.
+ */
+export declare class SimCfnStackDeployContext {
+    /** The CDK cloud assembly the Stack's template was synthesized into. */
+    cdkOutContext: SimCdkOutContext | undefined;
+    /** The principal the Stack's Resource work is authorized as. */
+    caller: SimAwsCaller | undefined;
+    /** The principal the Stack's CDK file assets are published as. */
+    assetsCaller: SimAwsCaller | undefined;
+    constructor(properties: SimCfnStackUpdateContext);
+    /**
+     * Take on what an update brings with it, for this and every later operation.
+     *
+     * A synthesis writes the template and the assets manifest beside it together,
+     * so a Stack updated from a re-synthesized template needs the manifest that
+     * came with it. Keeping the one the Stack was deployed from would look up the
+     * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
+     */
+    useUpdate(properties: SimCfnStackUpdateContext): void;
+    /**
+     * The principal file assets are published as, which is the deployment's own
+     * caller unless the deployment named one for publishing.
+     */
+    publishingCaller(): SimAwsCaller | undefined;
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.js

@@ -0,0 +1,46 @@
+/**
+ * What a Stack is deploying from, and who it is deploying as.
+ *
+ * These three travel together and are the only things an update replaces, so
+ * they are held apart from the rest of a Stack's Resource operations. An
+ * operation reads them here whenever it runs, rather than closing over the
+ * values the deployment started with.
+ */
+export class SimCfnStackDeployContext {
+    /** The CDK cloud assembly the Stack's template was synthesized into. */
+    cdkOutContext;
+    /** The principal the Stack's Resource work is authorized as. */
+    caller;
+    /** The principal the Stack's CDK file assets are published as. */
+    assetsCaller;
+    constructor(properties) {
+        this.cdkOutContext = properties.cdkOutContext;
+        this.caller = properties.caller;
+        this.assetsCaller = properties.assetsCaller;
+    }
+    /**
+     * Take on what an update brings with it, for this and every later operation.
+     *
+     * A synthesis writes the template and the assets manifest beside it together,
+     * so a Stack updated from a re-synthesized template needs the manifest that
+     * came with it. Keeping the one the Stack was deployed from would look up the
+     * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
+     */
+    useUpdate(properties) {
+        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
+        this.caller = properties.caller ?? this.caller;
+        this.assetsCaller = properties.assetsCaller ?? this.assetsCaller;
+    }
+    /**
+     * The principal file assets are published as, which is the deployment's own
+     * caller unless the deployment named one for publishing.
+     */
+    publishingCaller() {
+        return this.assetsCaller ?? this.caller;
+    }
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
+import { type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
 import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
@@ -28,6 +29,11 @@ interface SimCfnStackResourceOperationsProperties {
      * caller leaves each service to decide the request as the Account root.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the Stack's CDK file assets are published as, where that is
+     * somebody other than the caller its Resources are created as.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are started in.
      */
@@ -52,8 +58,7 @@ export declare class SimCfnStackResourceOperations {
     private readonly stackName;
     private readonly bindings;
     private readonly resourceOrder;
-    private cdkOutContext;
-    private caller;
+    private readonly context;
     /**
      * Resources an update kept in simulated AWS.
      *
@@ -64,23 +69,8 @@ export declare class SimCfnStackResourceOperations {
      */
     private readonly retainedByUpdates;
     constructor(properties: SimCfnStackResourceOperationsProperties);
-    /**
-     * Take on what an update brings with it, for this and every later operation.
-     *
-     * A synthesis writes the template and the assets manifest beside it together,
-     * so a Stack updated from a re-synthesized template needs the manifest that
-     * came with it. Keeping the one the Stack was deployed from would look up the
-     * asset a replaced Resource names in a manifest written before it existed.
-     *
-     * An update naming a caller runs as that one, and the Stack is torn down as
-     * it afterwards. An update that names none keeps the deployment's caller, so
-     * a Stack updated from a plain template path goes on running as whoever
-     * deployed it.
-     */
-    useUpdate(properties: {
-        readonly cdkOutContext?: SimCdkOutContext | undefined;
-        readonly caller?: SimAwsCaller | undefined;
-    }): void;
+    /** Take on what an update brings with it, for every later operation. */
+    useUpdate(properties: SimCfnStackUpdateContext): void;
     /**
      * Create every Resource in the given Stack Resource map.
      */

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -1,3 +1,4 @@
+import { SimCfnStackDeployContext, } from "./sim-cfn-stack-deploy-context.js";
 import { SimCdkAssetsPublisher } from "../cdk/assets/sim-cdk-assets-publisher.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import { simCfnStackRetainedLogicalIds } from "./teardown/sim-cfn-stack-retained-logical-ids.js";
@@ -24,8 +25,7 @@ export class SimCfnStackResourceOperations {
     stackName;
     bindings;
     resourceOrder;
-    cdkOutContext;
-    caller;
+    context;
     /**
      * Resources an update kept in simulated AWS.
      *
@@ -36,31 +36,17 @@ export class SimCfnStackResourceOperations {
      */
     retainedByUpdates = [];
     constructor(properties) {
-        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, resourceOrder, } = properties;
+        const { simAws, accountRegionScope, stackName, bindings, resourceOrder } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stackName = stackName;
-        this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
-        this.caller = caller;
         this.resourceOrder = resourceOrder;
+        this.context = new SimCfnStackDeployContext(properties);
     }
-    /**
-     * Take on what an update brings with it, for this and every later operation.
-     *
-     * A synthesis writes the template and the assets manifest beside it together,
-     * so a Stack updated from a re-synthesized template needs the manifest that
-     * came with it. Keeping the one the Stack was deployed from would look up the
-     * asset a replaced Resource names in a manifest written before it existed.
-     *
-     * An update naming a caller runs as that one, and the Stack is torn down as
-     * it afterwards. An update that names none keeps the deployment's caller, so
-     * a Stack updated from a plain template path goes on running as whoever
-     * deployed it.
-     */
+    /** Take on what an update brings with it, for every later operation. */
     useUpdate(properties) {
-        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
-        this.caller = properties.caller ?? this.caller;
+        this.context.useUpdate(properties);
     }
     /**
      * Create every Resource in the given Stack Resource map.
@@ -120,7 +106,7 @@ export class SimCfnStackResourceOperations {
                 simAws: this.simAws,
                 currentResources,
                 updatedResources,
-                caller: this.caller,
+                caller: this.context.caller,
             });
         }));
     }
@@ -173,8 +159,8 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
             stackName: this.stackName,
-            cdkOutContext: this.cdkOutContext,
-            caller: this.caller,
+            cdkOutContext: this.context.cdkOutContext,
+            assetsCaller: this.context.publishingCaller(),
         }).publish();
     }
     creator(resources) {
@@ -182,9 +168,9 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
-            cdkOutContext: this.cdkOutContext,
+            cdkOutContext: this.context.cdkOutContext,
             bindings: this.bindings,
-            caller: this.caller,
+            caller: this.context.caller,
             resourceOrder: this.resourceOrder,
         });
     }
@@ -193,7 +179,7 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
-            caller: this.caller,
+            caller: this.context.caller,
             retention,
         });
     }

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -38,7 +38,7 @@ export class SimCfnStack {
     stackOutputs;
     cfnTemplate;
     constructor(properties) {
-        const { simAws, accountRegionScope, background, stackName, stackId, template, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
+        const { simAws, accountRegionScope, background, stackName, stackId, template, cdkOutContext, bindings, caller, assetsCaller, resourceOrder, exports, } = properties;
         this.background = background;
         this.stackName = stackName;
         this.stackId = stackId;
@@ -61,6 +61,7 @@ export class SimCfnStack {
             cdkOutContext,
             bindings,
             caller,
+            assetsCaller,
             resourceOrder,
         });
         this.lifecycle = new SimCfnStackDeploymentLifecycle({

package/dist/service/cloudformation/stack/sim-cfn-stack.type.d.ts

@@ -24,6 +24,11 @@ export interface SimCfnStackUpdateProperties {
      * The Stack goes on using it, as it does the cloud assembly.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal to publish the re-synthesized file assets as, for an update
+     * that names one. The Stack goes on using it too.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationStackProperties {
     readonly simAws: SimAws;
@@ -44,6 +49,15 @@ export interface SimCloudFormationStackProperties {
      * simulation.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order this Stack starts Resources with no dependency between them in.
      * The template's own order unless the deployment asked for another one.

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfCachePolicyCreatorProperties {
  * Resources.
  */
 export declare class SimCfnCfCachePolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfCachePolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontCachePolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontCachePolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfCachePolicyConfig } from "./sim-cfn-cf-cache-policy-config.js";
  * Resources.
  */
 export class SimCfnCfCachePolicyCreator {
+    static createAction = "cloudfront:CreateCachePolicy";
+    static deleteAction = "cloudfront:DeleteCachePolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfCachePolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfCachePolicyCreator.createAction, options);
         const policy = new SimCfnCfCachePolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfCachePolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfCachePolicyCreator.deleteAction, `cache-policy/${policy.id}`, options);
         this.cloudFront.removeCachePolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfOriginAccessControlCreatorProperties {
  * AWS::CloudFront::OriginAccessControl Resources.
  */
 export declare class SimCfnCfOriginAccessControlCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfOriginAccessControlCreatorProperties);
     /**
      * Create and store the origin access control one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginAccessControl;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontOriginAccessControl;
     /**
      * Remove an origin access control created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfOriginAccessControlConfig } from "./sim-cfn-cf-oac-config.js";
  * AWS::CloudFront::OriginAccessControl Resources.
  */
 export class SimCfnCfOriginAccessControlCreator {
+    static createAction = "cloudfront:CreateOriginAccessControl";
+    static deleteAction = "cloudfront:DeleteOriginAccessControl";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfOriginAccessControlCreator {
     /**
      * Create and store the origin access control one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfOriginAccessControlCreator.createAction, options);
         const originAccessControl = new SimCfnCfOriginAccessControlConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfOriginAccessControlCreator {
     /**
      * Remove an origin access control created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const originAccessControl = resource.simResource;
         if (originAccessControl === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfOriginAccessControlCreator.deleteAction, `origin-access-control/${originAccessControl.id}`, options);
         this.cloudFront.removeOriginAccessControl(originAccessControl.id);
     }
 }

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfOriginRequestPolicyCreatorProperties {
  * AWS::CloudFront::OriginRequestPolicy Resources.
  */
 export declare class SimCfnCfOriginRequestPolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfOriginRequestPolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginRequestPolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontOriginRequestPolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};