@kensio/yulin 1.21.5 → 1.21.6

package/dist/service/iam/command/role/get-role/get-role.handler.js

@@ -1,5 +1,6 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
+import { simIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 /**
  * IAM GetRoleCommand handler.
  *
@@ -36,6 +37,7 @@ export class GetRoleCommandHandler {
                 CreateDate: role.creationDate,
                 AssumeRolePolicyDocument: role.assumeRolePolicyDocument,
                 Description: role.description,
+                PermissionsBoundary: simIamAttachedPermissionsBoundary(role),
             },
         };
     }

package/dist/service/iam/command/role/sim-iam-role-command-handlers.js

@@ -31,7 +31,7 @@ export class SimIamRoleCommandHandlers {
      * Handle a CreateRole command from the SDK.
      */
     async createRole(command, options) {
-        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller);
+        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller, permissionsBoundaryCondition(command.input.PermissionsBoundary));
         const handler = new CreateRoleCommandHandler({
             accountId: this.accountId,
             roles: this.roles,
@@ -123,3 +123,17 @@ export class SimIamRoleCommandHandlers {
         return `arn:aws:iam::${this.accountId}:role/${roleName ?? "*"}`;
     }
 }
+/**
+ * What a Role-creating request says about the boundary it declares.
+ *
+ * An account that requires a permissions boundary allows `iam:CreateRole`
+ * only under `StringEquals` on `iam:PermissionsBoundary`, and the CDK
+ * permissions-boundary guard is written that way. A request declaring no
+ * boundary leaves the key out, which is what refuses it: a positive operator
+ * over an absent key matches nothing.
+ */
+function permissionsBoundaryCondition(permissionsBoundary) {
+    return permissionsBoundary === undefined
+        ? undefined
+        : { "iam:PermissionsBoundary": permissionsBoundary };
+}

package/dist/service/iam/role/sim-iam-role-boundary.d.ts

@@ -0,0 +1,24 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamRole } from "./sim-iam-role.js";
+/**
+ * A permissions boundary attached to a Role, as IAM describes one.
+ *
+ * IAM answers with the attachment rather than the bare ARN, and the type has
+ * only ever taken one value.
+ */
+export interface SimIamAttachedPermissionsBoundary {
+    readonly PermissionsBoundaryType: "PermissionsBoundaryPolicy";
+    readonly PermissionsBoundaryArn: SimArn;
+}
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export declare const simIamAttachedBoundaryMembers: string[];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export declare function simIamAttachedPermissionsBoundary(role: SimIamRole): SimIamAttachedPermissionsBoundary | undefined;

package/dist/service/iam/role/sim-iam-role-boundary.js

@@ -0,0 +1,24 @@
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export const simIamAttachedBoundaryMembers = [
+    "PermissionsBoundaryType",
+    "PermissionsBoundaryArn",
+];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export function simIamAttachedPermissionsBoundary(role) {
+    const permissionsBoundaryArn = role.permissionsBoundaryArn;
+    if (permissionsBoundaryArn === undefined) {
+        return undefined;
+    }
+    return {
+        PermissionsBoundaryType: "PermissionsBoundaryPolicy",
+        PermissionsBoundaryArn: permissionsBoundaryArn,
+    };
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -56,4 +56,5 @@ export declare const simIamRoleWithPolicyFactory: AsyncMappedFactory<SimIamRoleW
     readonly CreateDate: Date;
     readonly AssumeRolePolicyDocument?: string | undefined;
     readonly Description?: string | undefined;
+    readonly PermissionsBoundary?: import("./sim-iam-role-boundary.js").SimIamAttachedPermissionsBoundary | undefined;
 }, SimAws>;

package/dist/service/iam/role/sim-iam-role.d.ts

@@ -19,6 +19,16 @@ export interface SimIamRole extends SimIamPrincipal {
     readonly assumeRolePolicyDocument?: JSONString<SimIamPolicyDocument> | undefined;
     readonly description?: string | undefined;
     readonly creationDate: Date;
+    /**
+     * ARN of the managed policy attached to this Role as its permissions
+     * boundary, where the request creating it declared one.
+     *
+     * This records what the Role was created with, so that a policy conditioned
+     * on `iam:PermissionsBoundary` can be tested against the Roles a deployment
+     * makes. The boundary is not yet evaluated as a policy source, so it does
+     * not narrow what the Role itself may do.
+     */
+    readonly permissionsBoundaryArn?: SimArn | undefined;
     /**
      * Inline identity-based permissions policies stored directly on this role.
      */

package/dist/service/iam/serve/sim-iam-query-entity.d.ts

@@ -7,5 +7,10 @@ import type { SimQueryOutput } from "../../../serve/http/api/query/sim-query-res
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[]): string;
+export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[], nested?: (entity: SimQueryOutput) => string): string;

package/dist/service/iam/serve/sim-iam-query-entity.js

@@ -12,10 +12,16 @@ import { xmlElement } from "../../../util/xml/xml-writer.js";
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export function iamQueryEntity(output, name, members) {
+export function iamQueryEntity(output, name, members, nested) {
     const entity = output[name];
-    return isRecord(entity)
-        ? xmlElement(name, queryMembers(entity, members))
-        : "";
+    if (!isRecord(entity)) {
+        return "";
+    }
+    return xmlElement(name, queryMembers(entity, members) + (nested?.(entity) ?? ""));
 }

package/dist/service/iam/serve/sim-iam-query-role-operations.js

@@ -1,4 +1,5 @@
-import { queryList, queryMembers, } from "../../../serve/http/api/query/sim-query-result.js";
+import { queryList, queryMembers, queryStructure, } from "../../../serve/http/api/query/sim-query-result.js";
+import { simIamAttachedBoundaryMembers } from "../role/sim-iam-role-boundary.js";
 import { iamQueryEntity } from "./sim-iam-query-entity.js";
 import { iamQueryListingInput, iamQueryListingResult, } from "./sim-iam-query-listing.js";
 /**
@@ -13,6 +14,16 @@ const roleMembers = [
     "AssumeRolePolicyDocument",
     "Description",
 ];
+/**
+ * Write the permissions boundary a Role carries, where it carries one.
+ *
+ * A boundary is a structure of its own, and `queryMembers` would write it as
+ * the JSON text of an object. `ListRoles` leaves the field out altogether, as
+ * IAM does, so only the create and the get pass this.
+ */
+function roleBoundary(role) {
+    return queryStructure(role, "PermissionsBoundary", (boundary) => queryMembers(boundary, simIamAttachedBoundaryMembers));
+}
 /**
  * The Role operations simulated IAM serves over the Query protocol.
  *
@@ -30,8 +41,9 @@ export function simIamQueryRoleOperations() {
                     Path: fields.text("Path"),
                     AssumeRolePolicyDocument: fields.text("AssumeRolePolicyDocument"),
                     Description: fields.text("Description"),
+                    PermissionsBoundary: fields.text("PermissionsBoundary"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [
@@ -40,7 +52,7 @@ export function simIamQueryRoleOperations() {
                 input: (fields) => ({
                     RoleName: fields.text("RoleName"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.d.ts

@@ -26,6 +26,12 @@ import type { SimCfnLambdaFunctionProperties } from "./sim-cfn-lambda-function-p
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export declare class SimCfnLambdaRuntimeSkip {
     /**

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.js

@@ -1,3 +1,4 @@
+import { SimCfnNamedSkip } from "../../../cloudformation/resource/unsupported/sim-cfn-named-skip.js";
 /**
  * Sim Lambda runs handler modules in a Node.js vm, so it simulates the
  * Node.js managed runtimes.
@@ -29,6 +30,12 @@ const nodeJsRuntimePrefix = "nodejs";
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export class SimCfnLambdaRuntimeSkip {
     /**
@@ -42,9 +49,9 @@ export class SimCfnLambdaRuntimeSkip {
             runtimeName.startsWith(nodeJsRuntimePrefix)) {
             return undefined;
         }
-        return new Error(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
+        return new SimCfnNamedSkip(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
             `sim Lambda simulates Node.js runtimes, and this function declares ` +
             `Runtime ${runtimeName}. Bind a real in-process handler to this ` +
-            `function to simulate it.`);
+            `function to simulate it.`, functionProperties.functionName);
     }
 }

package/dist/service/route53/command/create-hosted-zone/sim-route53-zone-id.js

@@ -34,10 +34,32 @@ export function makeSimRoute53HostedZoneId(existing = new Set()) {
 export function normalizeSimRoute53HostedZoneId(value) {
     const hostedZoneId = value?.replace(/^\/?hostedzone\//u, "");
     if (!isSimRoute53HostedZoneId(hostedZoneId)) {
-        throw new SimRoute53InvalidInput(`Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`);
+        throw new SimRoute53InvalidInput(rejectedSimRoute53HostedZoneId(value, hostedZoneId));
     }
     return hostedZoneId;
 }
+/**
+ * The literal CDK writes into a synthesized template when
+ * `HostedZone.fromLookup` runs against no credentials and no cached context.
+ */
+const cdkUnresolvedLookupHostedZoneId = "DUMMY";
+/**
+ * The message for a Hosted Zone ID that fails the shape check.
+ *
+ * CDK writes its unresolved lookup stand-in into every RecordSet of the
+ * synthesized template, and that value arrives here looking like any other
+ * malformed ID. Reporting it as one sends the reader to check an ID they never
+ * wrote, so the stand-in is named and the synth that produced it is pointed at.
+ */
+function rejectedSimRoute53HostedZoneId(value, hostedZoneId) {
+    const reported = `Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`;
+    if (hostedZoneId !== cdkUnresolvedLookupHostedZoneId) {
+        return reported;
+    }
+    return (`${reported}. CDK fills an unresolved \`HostedZone.fromLookup\` with this ` +
+        "stand-in. Run `cdk synth` with credentials for the account holding the " +
+        "zone, or commit the `cdk.context.json` a resolved lookup writes.");
+}
 /**
  * Whether a value has the shape of a Route53 Hosted Zone ID.
  */

package/docs/services/cloudformation/README.md

@@ -1055,8 +1055,15 @@ simulated CloudFront hostname, such as `e123example.cloudfront.net`.
 #### Values from a skipped Resource
 
 A Resource that was skipped, because its type is outside the simulation or because there is no
-simulated Resource to create at all, still answers both intrinsics. `Ref` returns the logical ID, and
-`Fn::GetAtt` returns the string `<logical ID>.<attribute name>`.
+simulated Resource to create at all, still answers both intrinsics.
+
+What `Ref` answers with follows how far the refusal got. A service that had already worked out the
+Resource's name answers with that name. That is the name real CloudFormation would have produced,
+and the simulation holds it whether or not the Resource behind it was created. Sim Lambda declining
+a function on its `Runtime` is the case to know about, and it covers CDK's own Python providers. A
+Resource refused before any name existed answers with the logical ID.
+
+`Fn::GetAtt` answers with the string `<logical ID>.<attribute name>` for either of them.
 
 ```typescript sim-cloudformation-skipped-resource-values
 /**
@@ -1071,28 +1078,31 @@ const stack = await simAws.cloudFormation().deployTemplate({
   stackName: "stand-in-stack",
   template: {
     Resources: {
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
     Outputs: {
-      AlarmRef: { Value: { Ref: "AlarmRule" } },
-      AlarmArn: { Value: { "Fn::GetAtt": ["AlarmRule", "Arn"] } },
+      SearchApiRef: { Value: { Ref: "SearchApi" } },
+      SearchApiArn: { Value: { "Fn::GetAtt": ["SearchApi", "Arn"] } },
     },
   },
 });
 
 await stack.waitForDeployComplete();
 
-console.log(stack.output("AlarmRef"));
-// "AlarmRule"
+console.log(stack.output("SearchApiRef"));
+// "SearchApi"
 
-console.log(stack.output("AlarmArn"));
-// "AlarmRule.Arn"
+console.log(stack.output("SearchApiArn"));
+// "SearchApi.Arn"
 
 for (const skipped of stack.skippedResources) {
   console.log(skipped.logicalId, skipped.skippedReason);
-  // "AlarmRule Unsupported sim CloudFormation Resource service CloudWatch"
+  // "SearchApi Unsupported sim CloudFormation Resource service AppSync"
 }
 ```
 
@@ -1101,7 +1111,7 @@ every Resource holding a `Ref` or `Fn::GetAtt` to a skipped Resource would fail
 every Resource depending on those, until one EventBridge rule took the whole stack down with it. The skip
 stays where it happened.
 
-A stand-in is deliberately shaped unlike an ARN. It fails closed wherever the simulator reads it.
+A logical ID is deliberately shaped unlike an ARN. It fails closed wherever the simulator reads it.
 
 - In an IAM policy `Resource` it matches no ARN, so a caller relying on that statement is denied.
 - In a property that is parsed as an ARN it is refused as malformed, and that Resource fails.
@@ -1112,9 +1122,58 @@ A stand-in is deliberately shaped unlike an ARN. It fails closed wherever the si
   SDK call fails the way a call for a missing resource does. A `PutItem` naming the skipped table
   gets `ResourceNotFoundException: No DynamoDB Table named Orders`.
 
-A stand-in stands in for something absent, and is never a value to rely on. A test asserting against
-one is asserting on a Resource that was never created. `stack.skippedResources` is where to find out
-which Resources those are and why, under
+A generated name behaves differently, and is meant to. It is the name an account would have held, so
+anything reading it reads a well-formed name. CDK writes a function's log group name as
+`/aws/lambda/` joined to a `Ref` of the function, and the log group is created under
+`/aws/lambda/<stack>-<logical ID>-<suffix>` even where the function was declined. A deploy Role
+scoped to `<stack>-*` and `/aws/lambda/<stack>-*` covers the deployment, the way it does on AWS.
+
+```typescript sim-cloudformation-skipped-resource-generated-name
+/**
+ * A function skipped on its Runtime, and the Log Group named after it.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+const stack = await simAws.cloudFormation().deployTemplate({
+  stackName: "ReportStack",
+  template: {
+    Resources: {
+      ReportFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          Role: "arn:aws:iam::111111111111:role/ReportRole",
+          Handler: "index.handler",
+          Runtime: "python3.13",
+          Code: { ZipFile: "def handler(event, context): return 'report'" },
+        },
+      },
+      ReportFunctionLogGroup: {
+        Type: "AWS::Logs::LogGroup",
+        Properties: {
+          LogGroupName: {
+            "Fn::Join": ["", ["/aws/lambda/", { Ref: "ReportFunction" }]],
+          },
+        },
+      },
+    },
+  },
+});
+
+await stack.waitForDeployComplete();
+
+console.log(stack.getResource("ReportFunction")?.refValue);
+// "ReportStack-ReportFunction-42d643ca8338"
+
+console.log(simAws.logs().allLogGroups()[0]?.logGroupName);
+// "/aws/lambda/ReportStack-ReportFunction-42d643ca8338"
+```
+
+The Resource is absent all the same, and the name is no evidence that it is there. Invoking the
+function above fails with `ResourceNotFoundException`. `stack.skippedResources` is where to find out
+which Resources were left out and why, under
 [Inspecting stacks and resources](#inspecting-stacks-and-resources).
 
 ### `Fn::Join`
@@ -3976,8 +4035,11 @@ const stack = await simAws.cloudFormation().deployTemplate({
           BucketName: "skipped-site-bucket",
         },
       },
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
   },
@@ -3986,10 +4048,10 @@ const stack = await simAws.cloudFormation().deployTemplate({
 await stack.waitForDeployComplete();
 
 console.log(stack.skippedResources.map((resource) => resource.logicalId));
-// ["AlarmRule"]
+// ["SearchApi"]
 
-console.log(stack.getResource("AlarmRule")?.skippedReason);
-// "Unsupported sim CloudFormation Resource service CloudWatch"
+console.log(stack.getResource("SearchApi")?.skippedReason);
+// "Unsupported sim CloudFormation Resource service AppSync"
 ```
 
 A skipped Resource is still there for `stack.getResource(...)`, and still answers `Ref` and `Fn::GetAtt` with
@@ -4033,8 +4095,11 @@ const stack = await simAws.cloudFormation().deployTemplate({
           Description: "/opt/awscli/aws",
         },
       },
-      AlarmRule: {
-        Type: "AWS::CloudWatch::Alarm",
+      SearchApi: {
+        Type: "AWS::AppSync::GraphQLApi",
+        Properties: {
+          Name: "search",
+        },
       },
     },
   },
@@ -4043,7 +4108,7 @@ const stack = await simAws.cloudFormation().deployTemplate({
 await stack.waitForDeployComplete();
 
 console.log(stack.skippedResources.map((resource) => resource.logicalId));
-// ["AlarmRule"]
+// ["SearchApi"]
 
 console.log(stack.inertResources.map((resource) => resource.logicalId));
 // ["AwsCliLayer"]

package/docs/services/cloudfront/README.md

@@ -259,6 +259,11 @@ with a 200 for a URL the Bucket has no object for. It is one of the same error c
 CloudFront allows. Where the response page is itself missing, the viewer gets the status from
 fetching it, as in CloudFront.
 
+Behind an origin access control, a response page the Bucket does not hold answers 403 where a public
+Bucket answers 404. The Bucket policy an origin access control is written with grants `s3:GetObject`
+and no `s3:ListBucket`, and S3 refuses a key whose absence it may not report. A test whose Bucket
+was never loaded with the site's error page sees that refusal in place of the page.
+
 A viewer-response function never sees a custom error page. CloudFront runs no viewer-response
 function once the Origin has answered 400 or higher, and simulated CloudFront does the same, for a
 CloudFront Function and a Lambda@Edge function alike. The status the Origin returned is what decides
@@ -3781,6 +3786,110 @@ A CDK stack needs no hand-editing.
 other store. Handing back an empty store would let a Function that lost its association run to
 completion and quietly take every default.
 
+## Permissions
+
+Every CloudFront command goes through simulated IAM. So does every CloudFront Resource a
+CloudFormation Stack creates, decided as the principal the deployment runs as. Stand a project's own
+execution policy up as a deploy Role and the Stack finds out what the policy leaves out. A
+deployment naming no principal is decided as the Account root.
+
+The action is the `cloudfront:` name of the operation. A Distribution action is decided against
+`arn:aws:cloudfront::<account>:distribution/<id>`, a Function action against `function/<name>` and a
+key value store action against `key-value-store/<id>`. A create action has nothing to name until it
+succeeds and is decided against `*`. A policy granting one has to write the wildcard.
+
+These are the actions the simulation asks about:
+
+- `CreateDistribution`, `GetDistribution`, `UpdateDistribution` and `DeleteDistribution`
+- `CreateFunction`, `ListFunctions`, `DescribeFunction`, `GetFunction` and `DeleteFunction`
+- `CreateInvalidation`, `GetInvalidation` and `ListInvalidations`
+- `CreateKeyValueStore`, `ListKeyValueStores`, `DescribeKeyValueStore`, `UpdateKeyValueStore` and
+  `DeleteKeyValueStore`, alongside the data API's own `cloudfront-keyvaluestore:` actions on the
+  keys inside a store
+- `CreateCachePolicy` and `DeleteCachePolicy`
+- `CreateOriginRequestPolicy` and `DeleteOriginRequestPolicy`
+- `CreateResponseHeadersPolicy` and `DeleteResponseHeadersPolicy`
+- `CreateOriginAccessControl` and `DeleteOriginAccessControl`
+
+The last four pairs reach IAM through CloudFormation alone, since a template is the only way to make
+one of those four here. Each delete is decided against the ARN of the thing it names, such as
+`arn:aws:cloudfront::<account>:cache-policy/<id>`.
+
+```typescript sim-cloudfront-deploy-permissions
+/**
+ * A deploy Role refused the cache policy its Stack declares.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+// A deploy Role allowed CloudFormation and S3, and no CloudFront action.
+const { Role } = await simAws.iam().createRole({
+  input: {
+    RoleName: "DeployRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "cloudformation.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  },
+});
+
+await simAws.iam().putRolePolicy({
+  input: {
+    RoleName: "DeployRole",
+    PolicyName: "DeployPolicy",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: ["cloudformation:*", "s3:*"],
+          Resource: "*",
+        },
+      ],
+    }),
+  },
+});
+
+try {
+  await simAws.cloudFormation().deployTemplate({
+    stackName: "site-stack",
+    caller: { kind: "arn", arn: Role.Arn },
+    template: {
+      Resources: {
+        SiteCachePolicy: {
+          Type: "AWS::CloudFront::CachePolicy",
+          Properties: {
+            CachePolicyConfig: {
+              Name: "site-caching",
+              MinTTL: 0,
+              ParametersInCacheKeyAndForwardedToOrigin: {
+                EnableAcceptEncodingGzip: false,
+                CookiesConfig: { CookieBehavior: "none" },
+                HeadersConfig: { HeaderBehavior: "none" },
+                QueryStringsConfig: { QueryStringBehavior: "none" },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+} catch (error) {
+  // Sim CloudFormation Resource SiteCachePolicy creation failed: User:
+  // arn:aws:iam::...:role/DeployRole is not authorized to perform:
+  // cloudfront:CreateCachePolicy on resource: *
+  console.log((error as Error).message);
+}
+```
+
 ## Available functionality
 
 Sim CloudFront currently supports: