@kensio/yulin 1.21.5 → 1.21.7

package/dist/service/cloudformation/resource/cfn/sim-cfn-default-resource-value-adapter.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnTemplateValue } from "../../template/value/sim-cfn-template-
 import type { SimCfnResourceValueAdapter } from "./sim-cfn-resource-value-adapter.js";
 interface SimCfnDefaultResourceValueAdapterProperties {
     readonly logicalId: string;
+    readonly uncreatedPhysicalName?: string | undefined;
 }
 /**
  * Fallback CloudFormation-facing values for Resource types without specific
@@ -9,9 +10,15 @@ interface SimCfnDefaultResourceValueAdapterProperties {
  */
 export declare class SimCfnDefaultResourceValueAdapter implements SimCfnResourceValueAdapter {
     private readonly logicalId;
+    private readonly uncreatedPhysicalName;
     constructor(properties: SimCfnDefaultResourceValueAdapterProperties);
     /**
-     * Default physical-ID stand-in.
+     * The physical ID this Resource would have had, or the logical-ID stand-in.
+     *
+     * A service that worked out the Resource's name before refusing to create it
+     * leaves the simulation holding the name real CloudFormation would have
+     * produced. That is what Ref answers with. The logical ID is left for a
+     * Resource nothing ever named.
      */
     refValue(): SimCfnTemplateValue;
     /**

package/dist/service/cloudformation/resource/cfn/sim-cfn-default-resource-value-adapter.js

@@ -5,14 +5,21 @@ import { simCfnUnansweredAttribute } from "./sim-cfn-unanswered-attribute.js";
  */
 export class SimCfnDefaultResourceValueAdapter {
     logicalId;
+    uncreatedPhysicalName;
     constructor(properties) {
         this.logicalId = properties.logicalId;
+        this.uncreatedPhysicalName = properties.uncreatedPhysicalName;
     }
     /**
-     * Default physical-ID stand-in.
+     * The physical ID this Resource would have had, or the logical-ID stand-in.
+     *
+     * A service that worked out the Resource's name before refusing to create it
+     * leaves the simulation holding the name real CloudFormation would have
+     * produced. That is what Ref answers with. The logical ID is left for a
+     * Resource nothing ever named.
      */
     refValue() {
-        return this.logicalId;
+        return this.uncreatedPhysicalName ?? this.logicalId;
     }
     /**
      * Default attribute stand-in.

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.d.ts

@@ -7,6 +7,11 @@ export interface SimCfnResourceValueAdapterProperties {
     readonly logicalId: string;
     readonly type: string | undefined;
     readonly simResource: object | undefined;
+    /**
+     * The name real CloudFormation would have given the Resource, where the
+     * service knew it before deciding not to create it.
+     */
+    readonly uncreatedPhysicalName?: string | undefined;
 }
 /**
  * The adapter for a Resource type one service owns, or nothing when the
@@ -23,6 +28,6 @@ export type SimCfnServiceValueAdapter = SimCfnResourceValueAdapter | undefined;
  * Each service matches its own Resource types, beside that service's adapters,
  * so this registry stays a list of services. A Resource no service claims
  * falls through to the default adapter, which answers a Ref with the logical
- * ID.
+ * ID, or with the name a service worked out before refusing the Resource.
  */
 export declare function simCfnResourceValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnResourceValueAdapter;

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.js

@@ -10,7 +10,7 @@ import { simCfnServiceValueAdapters } from "./sim-cfn-service-value-adapters.js"
  * Each service matches its own Resource types, beside that service's adapters,
  * so this registry stays a list of services. A Resource no service claims
  * falls through to the default adapter, which answers a Ref with the logical
- * ID.
+ * ID, or with the name a service worked out before refusing the Resource.
  */
 export function simCfnResourceValueAdapter(properties) {
     for (const serviceAdapter of simCfnServiceValueAdapters) {
@@ -21,5 +21,6 @@ export function simCfnResourceValueAdapter(properties) {
     }
     return new SimCfnDefaultResourceValueAdapter({
         logicalId: properties.logicalId,
+        uncreatedPhysicalName: properties.uncreatedPhysicalName,
     });
 }

package/dist/service/cloudformation/resource/create/sim-cfn-resource-create-operation.d.ts

@@ -39,6 +39,10 @@ export declare class SimCfnResourceCreateOperation<T extends object = object> {
      * a gap and is skipped, unless nothing this simulator models could have told
      * it apart from one that was created, in which case saying it is missing
      * sends a reader after something that is not lost.
+     *
+     * Either way the Resource keeps whatever name the refusal carried. A
+     * template reading a Ref of it then gets the name real CloudFormation would
+     * have produced.
      */
     private recordUncreated;
     private resourceCreationError;

package/dist/service/cloudformation/resource/create/sim-cfn-resource-create-operation.js

@@ -1,6 +1,7 @@
 import { SimCfnResourceCreator } from "./sim-cfn-resource-creator.js";
 import { simCfnInertResourceReason } from "../inert/sim-cfn-inert-resource.js";
 import { isSimCfnUnsupportedResourceError } from "../unsupported/sim-cfn-unsupported-resource.js";
+import { simCfnSkippedPhysicalName } from "../unsupported/sim-cfn-named-skip.js";
 /**
  * Runs the asynchronous CloudFormation Resource creation lifecycle.
  *
@@ -63,8 +64,13 @@ export class SimCfnResourceCreateOperation {
      * a gap and is skipped, unless nothing this simulator models could have told
      * it apart from one that was created, in which case saying it is missing
      * sends a reader after something that is not lost.
+     *
+     * Either way the Resource keeps whatever name the refusal carried. A
+     * template reading a Ref of it then gets the name real CloudFormation would
+     * have produced.
      */
     recordUncreated(error, context) {
+        this.resource.recordUncreatedPhysicalName(simCfnSkippedPhysicalName(error));
         const inertReason = simCfnInertResourceReason(this.resource, context.resources);
         if (inertReason !== undefined) {
             this.resource.markCreateInert(inertReason);

package/dist/service/cloudformation/resource/sim-cfn-resource-record.d.ts

@@ -18,6 +18,7 @@ import type { SimCfnResourceResolveContext, SimCloudFormationResourceProperties
  * be calling.
  */
 export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgnorer {
+    #private;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly logicalId: string;
     /** The Stack this Resource belongs to, where a generated name comes from. */
@@ -32,6 +33,14 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * The simulated AWS object created for this CloudFormation Resource.
      */
     abstract get simResource(): object | undefined;
+    /**
+     * The name real CloudFormation would have given this Resource, where a
+     * service worked it out before refusing to create it.
+     *
+     * A Resource with a name behind it answers Ref with that name. The
+     * logical-ID stand-in is left for a Resource nothing ever named.
+     */
+    get uncreatedPhysicalName(): string | undefined;
     /**
      * The properties this Resource was created without acting on.
      */
@@ -97,6 +106,12 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * only thing that knows whether a property changes behaviour it simulates.
      */
     ignoreProperty(path: string, reason: string): void;
+    /**
+     * Record the name a service worked out for this Resource before refusing to
+     * create it. Called by the creation operation, which is where a refusal
+     * carrying a name is read.
+     */
+    recordUncreatedPhysicalName(physicalName: string | undefined): void;
     /**
      * The value returned when this Resource is referenced via Fn::GetAtt.
      *
@@ -132,5 +147,9 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * again.
      */
     protected clearIgnoredProperties(): void;
+    /**
+     * Forget the name a refusal recorded, for a Resource being created again.
+     */
+    protected clearUncreatedPhysicalName(): void;
     private cfnValueAdapter;
 }

package/dist/service/cloudformation/resource/sim-cfn-resource-record.js

@@ -25,6 +25,7 @@ export class SimCfnResourceRecord {
     /** The Stack this Resource belongs to, where a generated name comes from. */
     stackName;
     template;
+    #uncreatedPhysicalName;
     ignoredPropertyList = new SimCfnIgnoredProperties();
     resourceTemplateReader;
     propertyResolver;
@@ -54,6 +55,16 @@ export class SimCfnResourceRecord {
         });
         this.resourceLogicalIds = resourceLogicalIds;
     }
+    /**
+     * The name real CloudFormation would have given this Resource, where a
+     * service worked it out before refusing to create it.
+     *
+     * A Resource with a name behind it answers Ref with that name. The
+     * logical-ID stand-in is left for a Resource nothing ever named.
+     */
+    get uncreatedPhysicalName() {
+        return this.#uncreatedPhysicalName;
+    }
     /**
      * The properties this Resource was created without acting on.
      */
@@ -140,6 +151,14 @@ export class SimCfnResourceRecord {
     ignoreProperty(path, reason) {
         this.ignoredPropertyList.record(this, path, reason);
     }
+    /**
+     * Record the name a service worked out for this Resource before refusing to
+     * create it. Called by the creation operation, which is where a refusal
+     * carrying a name is read.
+     */
+    recordUncreatedPhysicalName(physicalName) {
+        this.#uncreatedPhysicalName = physicalName;
+    }
     /**
      * The value returned when this Resource is referenced via Fn::GetAtt.
      *
@@ -183,11 +202,18 @@ export class SimCfnResourceRecord {
     clearIgnoredProperties() {
         this.ignoredPropertyList.clear();
     }
+    /**
+     * Forget the name a refusal recorded, for a Resource being created again.
+     */
+    clearUncreatedPhysicalName() {
+        this.#uncreatedPhysicalName = undefined;
+    }
     cfnValueAdapter() {
         return simCfnResourceValueAdapter({
             logicalId: this.logicalId,
             type: this.type,
             simResource: this.simResource,
+            uncreatedPhysicalName: this.uncreatedPhysicalName,
         });
     }
 }

package/dist/service/cloudformation/resource/sim-cfn-resource.js

@@ -176,6 +176,7 @@ export class SimCfnResource extends SimCfnResourceRecord {
      */
     markCreateInProgress() {
         this.clearIgnoredProperties();
+        this.clearUncreatedPhysicalName();
         this.creationState.markCreateInProgress();
     }
     /**

package/dist/service/cloudformation/resource/unsupported/sim-cfn-named-skip.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A refusal from a service that had already worked out the name real
+ * CloudFormation would give the Resource.
+ *
+ * The logical ID a skipped Resource answers `Ref` with stands in for a value
+ * the simulation does not hold. Where a service names a Resource before
+ * refusing it, the simulation does hold one, so raising this carries the name
+ * through the refusal and the Resource answers `Ref` with it. Sim Lambda
+ * declining a function on its Runtime is the case that needs it: CDK writes a
+ * log group name as `/aws/lambda/` joined to a `Ref` of the function, and a
+ * logical ID there produces a log group under a name no account would hold.
+ *
+ * Nothing else about the refusal changes. The message still decides whether
+ * the Stack records a skip or fails. A service raising this says "Unsupported
+ * sim ... CloudFormation" as it would in an ordinary Error.
+ */
+export declare class SimCfnNamedSkip extends Error {
+    readonly physicalName: string;
+    readonly name = "SimCfnNamedSkip";
+    constructor(message: string, physicalName: string);
+}
+/**
+ * The name a refusal carries, or nothing where the service had not named the
+ * Resource before refusing it.
+ */
+export declare function simCfnSkippedPhysicalName(error: unknown): string | undefined;

package/dist/service/cloudformation/resource/unsupported/sim-cfn-named-skip.js

@@ -0,0 +1,31 @@
+/**
+ * A refusal from a service that had already worked out the name real
+ * CloudFormation would give the Resource.
+ *
+ * The logical ID a skipped Resource answers `Ref` with stands in for a value
+ * the simulation does not hold. Where a service names a Resource before
+ * refusing it, the simulation does hold one, so raising this carries the name
+ * through the refusal and the Resource answers `Ref` with it. Sim Lambda
+ * declining a function on its Runtime is the case that needs it: CDK writes a
+ * log group name as `/aws/lambda/` joined to a `Ref` of the function, and a
+ * logical ID there produces a log group under a name no account would hold.
+ *
+ * Nothing else about the refusal changes. The message still decides whether
+ * the Stack records a skip or fails. A service raising this says "Unsupported
+ * sim ... CloudFormation" as it would in an ordinary Error.
+ */
+export class SimCfnNamedSkip extends Error {
+    physicalName;
+    name = "SimCfnNamedSkip";
+    constructor(message, physicalName) {
+        super(message);
+        this.physicalName = physicalName;
+    }
+}
+/**
+ * The name a refusal carries, or nothing where the service had not named the
+ * Resource before refusing it.
+ */
+export function simCfnSkippedPhysicalName(error) {
+    return error instanceof SimCfnNamedSkip ? error.physicalName : undefined;
+}

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfCachePolicyCreatorProperties {
  * Resources.
  */
 export declare class SimCfnCfCachePolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfCachePolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontCachePolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontCachePolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfCachePolicyConfig } from "./sim-cfn-cf-cache-policy-config.js";
  * Resources.
  */
 export class SimCfnCfCachePolicyCreator {
+    static createAction = "cloudfront:CreateCachePolicy";
+    static deleteAction = "cloudfront:DeleteCachePolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfCachePolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfCachePolicyCreator.createAction, options);
         const policy = new SimCfnCfCachePolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfCachePolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfCachePolicyCreator.deleteAction, `cache-policy/${policy.id}`, options);
         this.cloudFront.removeCachePolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfOriginAccessControlCreatorProperties {
  * AWS::CloudFront::OriginAccessControl Resources.
  */
 export declare class SimCfnCfOriginAccessControlCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfOriginAccessControlCreatorProperties);
     /**
      * Create and store the origin access control one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginAccessControl;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontOriginAccessControl;
     /**
      * Remove an origin access control created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfOriginAccessControlConfig } from "./sim-cfn-cf-oac-config.js";
  * AWS::CloudFront::OriginAccessControl Resources.
  */
 export class SimCfnCfOriginAccessControlCreator {
+    static createAction = "cloudfront:CreateOriginAccessControl";
+    static deleteAction = "cloudfront:DeleteOriginAccessControl";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfOriginAccessControlCreator {
     /**
      * Create and store the origin access control one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfOriginAccessControlCreator.createAction, options);
         const originAccessControl = new SimCfnCfOriginAccessControlConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfOriginAccessControlCreator {
     /**
      * Remove an origin access control created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const originAccessControl = resource.simResource;
         if (originAccessControl === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfOriginAccessControlCreator.deleteAction, `origin-access-control/${originAccessControl.id}`, options);
         this.cloudFront.removeOriginAccessControl(originAccessControl.id);
     }
 }

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfOriginRequestPolicyCreatorProperties {
  * AWS::CloudFront::OriginRequestPolicy Resources.
  */
 export declare class SimCfnCfOriginRequestPolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfOriginRequestPolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginRequestPolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontOriginRequestPolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfOriginRequestPolicyConfig } from "./sim-cfn-cf-orp-config.js";
  * AWS::CloudFront::OriginRequestPolicy Resources.
  */
 export class SimCfnCfOriginRequestPolicyCreator {
+    static createAction = "cloudfront:CreateOriginRequestPolicy";
+    static deleteAction = "cloudfront:DeleteOriginRequestPolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfOriginRequestPolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfOriginRequestPolicyCreator.createAction, options);
         const policy = new SimCfnCfOriginRequestPolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfOriginRequestPolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfOriginRequestPolicyCreator.deleteAction, `origin-request-policy/${policy.id}`, options);
         this.cloudFront.removeOriginRequestPolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-creators.d.ts

@@ -0,0 +1,33 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+/**
+ * What the four creators in here have in common.
+ *
+ * Each builds its own kind of policy from a Resource's properties and stores
+ * it on the simulated CloudFront, and each authorizes the deployment's caller
+ * for its own pair of actions.
+ */
+interface SimCfnCfPolicyCreator {
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): object;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
+}
+/**
+ * The CloudFront Resource types a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here. The Resource factory hands
+ * all four to this one lookup, and its own switch stays about the Resource
+ * types a command creates.
+ */
+export declare class SimCfnCfPolicyCreators {
+    private readonly creators;
+    constructor(cloudFront: SimCloudFront);
+    /**
+     * The creator owning one Resource type, or nothing where another part of
+     * the factory owns it.
+     */
+    creatorFor(resourceTypeName: string): SimCfnCfPolicyCreator | undefined;
+}
+export {};

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-creators.js

@@ -0,0 +1,39 @@
+import { SimCfnCfCachePolicyCreator } from "../cache-policy/sim-cfn-cf-cache-policy-creator.js";
+import { SimCfnCfOriginAccessControlCreator } from "../origin-access-control/sim-cfn-cf-oac-creator.js";
+import { SimCfnCfOriginRequestPolicyCreator } from "../origin-request-policy/sim-cfn-cf-orp-creator.js";
+import { SimCfnCfResponseHeadersPolicyCreator } from "../response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
+/**
+ * The CloudFront Resource types a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here. The Resource factory hands
+ * all four to this one lookup, and its own switch stays about the Resource
+ * types a command creates.
+ */
+export class SimCfnCfPolicyCreators {
+    creators;
+    constructor(cloudFront) {
+        this.creators = new Map([
+            [
+                "ResponseHeadersPolicy",
+                new SimCfnCfResponseHeadersPolicyCreator({ cloudFront }),
+            ],
+            ["CachePolicy", new SimCfnCfCachePolicyCreator({ cloudFront })],
+            [
+                "OriginRequestPolicy",
+                new SimCfnCfOriginRequestPolicyCreator({ cloudFront }),
+            ],
+            [
+                "OriginAccessControl",
+                new SimCfnCfOriginAccessControlCreator({ cloudFront }),
+            ],
+        ]);
+    }
+    /**
+     * The creator owning one Resource type, or nothing where another part of
+     * the factory owns it.
+     */
+    creatorFor(resourceTypeName) {
+        return this.creators.get(resourceTypeName);
+    }
+}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfResponseHeadersPolicyCreatorProperties {
  * AWS::CloudFront::ResponseHeadersPolicy Resources.
  */
 export declare class SimCfnCfResponseHeadersPolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfResponseHeadersPolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontResponseHeadersPolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontResponseHeadersPolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfResponseHeadersPolicyConfig } from "./sim-cfn-cf-rh-policy-conf
  * AWS::CloudFront::ResponseHeadersPolicy Resources.
  */
 export class SimCfnCfResponseHeadersPolicyCreator {
+    static createAction = "cloudfront:CreateResponseHeadersPolicy";
+    static deleteAction = "cloudfront:DeleteResponseHeadersPolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfResponseHeadersPolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfResponseHeadersPolicyCreator.createAction, options);
         const policy = new SimCfnCfResponseHeadersPolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfResponseHeadersPolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfResponseHeadersPolicyCreator.deleteAction, `response-headers-policy/${policy.id}`, options);
         this.cloudFront.removeResponseHeadersPolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/sim-cfn-cf-authorizer.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface SimCfnCfAuthorizerProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Authorizes the CloudFront Resources a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here, so their CloudFormation
+ * creators reach the stored policy directly rather than through a command that
+ * would ask IAM on the way. This is where those creators ask instead, so a
+ * deploy Role holding no CloudFront permission is refused the way real
+ * CloudFormation refuses it.
+ */
+export declare class SimCfnCfAuthorizer {
+    private readonly accountId;
+    private readonly iam;
+    constructor(properties: SimCfnCfAuthorizerProperties);
+    /**
+     * Ensure the caller may take an action that names nothing yet.
+     *
+     * A create action has no ID to authorize against until it succeeds, and
+     * CloudFront offers no resource-level permission for one, so a policy
+     * granting it writes `*` and that is what it is decided against.
+     */
+    authorizeAny(action: string, options?: SimCfnResourceCallerOptions): void;
+    /**
+     * Ensure the caller may take an action on the CloudFront resource a path
+     * names, such as `cache-policy/8f1a2b3c`.
+     *
+     * A delete names the thing it is deleting, so a policy can grant deleting
+     * one cache policy without granting deleting every cache policy in the
+     * Account.
+     */
+    authorizeResource(action: string, resourcePath: string, options?: SimCfnResourceCallerOptions): void;
+}
+export {};