@kensio/yulin 1.21.5 → 1.21.7

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js

@@ -20,6 +20,7 @@ export class SimCfnIamRoleCreator {
                 Path: roleProperties.path,
                 Description: roleProperties.description,
                 AssumeRolePolicyDocument: roleProperties.assumeRolePolicyDocument,
+                PermissionsBoundary: roleProperties.permissionsBoundary,
             },
         }, options);
         await Promise.all([

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts

@@ -6,6 +6,7 @@ export interface SimCfnIamRoleProperties {
     readonly path: string | undefined;
     readonly description: string | undefined;
     readonly assumeRolePolicyDocument: string;
+    readonly permissionsBoundary: string | undefined;
     readonly inlinePolicies: readonly SimCfnIamInlinePolicy[];
     readonly managedPolicyArns: readonly string[];
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,6 +1,9 @@
+/* oxlint-disable security/detect-object-injection -- each lookup here reads a
+   template property under the name this parser asks for by literal. */
 import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
-import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
+import { simCfnIamJsonObject, simCfnIamOptionalString, } from "../sim-cfn-iam-property.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
+const resourceType = "AWS::IAM::Role";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
  * the sim IAM Role creator needs.
@@ -10,34 +13,38 @@ import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
  */
 export class SimCfnIamRolePropertiesParser {
     policiesParser = new SimCfnIamPoliciesParser({
-        resourceType: "AWS::IAM::Role",
+        resourceType,
     });
     /**
      * Parse the resolved CloudFormation properties for an AWS::IAM::Role.
      */
     parse(resource, properties) {
         return {
-            roleName: this.optionalString(resource, properties["RoleName"], "RoleName") ??
+            roleName: this.optionalString(resource, properties, "RoleName") ??
                 simCfnIamPrincipalGeneratedName(resource),
-            path: this.optionalString(resource, properties["Path"], "Path"),
-            description: this.optionalString(resource, properties["Description"], "Description"),
-            assumeRolePolicyDocument: this.jsonObject(resource, properties["AssumeRolePolicyDocument"], "AssumeRolePolicyDocument"),
+            path: this.optionalString(resource, properties, "Path"),
+            description: this.optionalString(resource, properties, "Description"),
+            assumeRolePolicyDocument: this.jsonObject(resource, properties),
+            permissionsBoundary: this.optionalString(resource, properties, "PermissionsBoundary"),
             inlinePolicies: this.policiesParser.inlinePolicies(resource, properties),
             managedPolicyArns: this.policiesParser.managedPolicyArns(resource, properties),
         };
     }
-    optionalString(resource, value, label) {
+    optionalString(resource, properties, label) {
         return simCfnIamOptionalString({
-            resourceType: "AWS::IAM::Role",
+            resourceType,
             resource,
-            value,
+            value: properties[label],
             label,
         });
     }
-    jsonObject(resource, value, label) {
-        if (typeof value !== "object" || value === null || Array.isArray(value)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ${label} must be an object`);
-        }
-        return JSON.stringify(value);
+    jsonObject(resource, properties) {
+        const label = "AssumeRolePolicyDocument";
+        return simCfnIamJsonObject({
+            resourceType,
+            resource,
+            value: properties[label],
+            label,
+        });
     }
 }

package/dist/service/iam/cfn/{sim-cfn-iam-optional-string.d.ts → sim-cfn-iam-property.d.ts}

@@ -1,6 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
-interface SimCfnIamOptionalStringProperties {
+interface SimCfnIamPropertyInput {
     readonly resourceType: string;
     readonly resource: SimCfnResource;
     readonly value: SimCfnTemplateValueRecord[string] | undefined;
@@ -13,5 +13,13 @@ interface SimCfnIamOptionalStringProperties {
  * refuse a non-string the same way, naming the Resource type the template
  * declared.
  */
-export declare function simCfnIamOptionalString(properties: SimCfnIamOptionalStringProperties): string | undefined;
+export declare function simCfnIamOptionalString(properties: SimCfnIamPropertyInput): string | undefined;
+/**
+ * Read a JSON-object property an IAM Resource requires.
+ *
+ * A Role's trust policy arrives as the object the template wrote, and IAM
+ * takes its policy documents as JSON text. A value of any other shape fails
+ * the Resource, naming the Resource type the template declared.
+ */
+export declare function simCfnIamJsonObject(properties: SimCfnIamPropertyInput): string;
 export {};

package/dist/service/iam/cfn/sim-cfn-iam-property.js

@@ -0,0 +1,31 @@
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export function simCfnIamOptionalString(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
+    }
+    return value;
+}
+/**
+ * Read a JSON-object property an IAM Resource requires.
+ *
+ * A Role's trust policy arrives as the object the template wrote, and IAM
+ * takes its policy documents as JSON text. A value of any other shape fails
+ * the Resource, naming the Resource type the template declared.
+ */
+export function simCfnIamJsonObject(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be an object`);
+    }
+    return JSON.stringify(value);
+}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-properties-parser.js

@@ -1,5 +1,5 @@
 import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
-import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-property.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 const resourceType = "AWS::IAM::User";
 /**

package/dist/service/iam/command/role/create-role/create-role-record-factory.js

@@ -1,4 +1,5 @@
 import { makeSimIamRoleId } from "../../../role/sim-iam-role-id.js";
+import { simIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 /**
  * Creates simulated IAM Role records and command outputs.
  */
@@ -19,6 +20,7 @@ export class CreateRoleRecordFactory {
             assumeRolePolicyDocument: cmd.input.AssumeRolePolicyDocument,
             description: cmd.input.Description,
             creationDate,
+            permissionsBoundaryArn: cmd.input.PermissionsBoundary,
             inlinePolicies: new Map(),
             attachedPolicyArns: new Set(),
         };
@@ -36,6 +38,7 @@ export class CreateRoleRecordFactory {
                 CreateDate: role.creationDate,
                 AssumeRolePolicyDocument: role.assumeRolePolicyDocument,
                 Description: role.description,
+                PermissionsBoundary: simIamAttachedPermissionsBoundary(role),
             },
         };
     }

package/dist/service/iam/command/role/create-role/create-role.command.d.ts

@@ -1,9 +1,18 @@
 import type { SimArn } from "../../../../aws/arn.js";
+import type { SimIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 export interface SimCreateRoleCommandInput {
     readonly RoleName?: string | undefined;
     readonly Path?: string | undefined;
     readonly AssumeRolePolicyDocument?: string | undefined;
     readonly Description?: string | undefined;
+    /**
+     * ARN of the managed policy to attach to the new Role as its permissions
+     * boundary.
+     *
+     * The request carries this ARN as `iam:PermissionsBoundary`, which is the
+     * key an account requiring a boundary conditions `iam:CreateRole` on.
+     */
+    readonly PermissionsBoundary?: string | undefined;
 }
 export interface SimCreateRoleCommand {
     readonly input: SimCreateRoleCommandInput;
@@ -17,5 +26,6 @@ export interface SimCreateRoleCommandOutput {
         readonly CreateDate: Date;
         readonly AssumeRolePolicyDocument?: string | undefined;
         readonly Description?: string | undefined;
+        readonly PermissionsBoundary?: SimIamAttachedPermissionsBoundary | undefined;
     };
 }

package/dist/service/iam/command/role/get-role/get-role.command.d.ts

@@ -1,5 +1,6 @@
 import type { SimArn } from "../../../../aws/arn.js";
 import type { SimIamRoleName } from "../../../role/sim-iam-role.js";
+import type { SimIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 export interface SimGetRoleCommandInput {
     readonly RoleName?: string | undefined;
 }
@@ -15,5 +16,6 @@ export interface SimGetRoleCommandOutput {
         readonly CreateDate: Date;
         readonly AssumeRolePolicyDocument?: string | undefined;
         readonly Description?: string | undefined;
+        readonly PermissionsBoundary?: SimIamAttachedPermissionsBoundary | undefined;
     };
 }

package/dist/service/iam/command/role/get-role/get-role.handler.js

@@ -1,5 +1,6 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
+import { simIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 /**
  * IAM GetRoleCommand handler.
  *
@@ -36,6 +37,7 @@ export class GetRoleCommandHandler {
                 CreateDate: role.creationDate,
                 AssumeRolePolicyDocument: role.assumeRolePolicyDocument,
                 Description: role.description,
+                PermissionsBoundary: simIamAttachedPermissionsBoundary(role),
             },
         };
     }

package/dist/service/iam/command/role/sim-iam-role-command-handlers.js

@@ -31,7 +31,7 @@ export class SimIamRoleCommandHandlers {
      * Handle a CreateRole command from the SDK.
      */
     async createRole(command, options) {
-        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller);
+        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller, permissionsBoundaryCondition(command.input.PermissionsBoundary));
         const handler = new CreateRoleCommandHandler({
             accountId: this.accountId,
             roles: this.roles,
@@ -123,3 +123,17 @@ export class SimIamRoleCommandHandlers {
         return `arn:aws:iam::${this.accountId}:role/${roleName ?? "*"}`;
     }
 }
+/**
+ * What a Role-creating request says about the boundary it declares.
+ *
+ * An account that requires a permissions boundary allows `iam:CreateRole`
+ * only under `StringEquals` on `iam:PermissionsBoundary`, and the CDK
+ * permissions-boundary guard is written that way. A request declaring no
+ * boundary leaves the key out, which is what refuses it: a positive operator
+ * over an absent key matches nothing.
+ */
+function permissionsBoundaryCondition(permissionsBoundary) {
+    return permissionsBoundary === undefined
+        ? undefined
+        : { "iam:PermissionsBoundary": permissionsBoundary };
+}

package/dist/service/iam/role/sim-iam-role-boundary.d.ts

@@ -0,0 +1,24 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamRole } from "./sim-iam-role.js";
+/**
+ * A permissions boundary attached to a Role, as IAM describes one.
+ *
+ * IAM answers with the attachment rather than the bare ARN, and the type has
+ * only ever taken one value.
+ */
+export interface SimIamAttachedPermissionsBoundary {
+    readonly PermissionsBoundaryType: "PermissionsBoundaryPolicy";
+    readonly PermissionsBoundaryArn: SimArn;
+}
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export declare const simIamAttachedBoundaryMembers: string[];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export declare function simIamAttachedPermissionsBoundary(role: SimIamRole): SimIamAttachedPermissionsBoundary | undefined;

package/dist/service/iam/role/sim-iam-role-boundary.js

@@ -0,0 +1,24 @@
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export const simIamAttachedBoundaryMembers = [
+    "PermissionsBoundaryType",
+    "PermissionsBoundaryArn",
+];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export function simIamAttachedPermissionsBoundary(role) {
+    const permissionsBoundaryArn = role.permissionsBoundaryArn;
+    if (permissionsBoundaryArn === undefined) {
+        return undefined;
+    }
+    return {
+        PermissionsBoundaryType: "PermissionsBoundaryPolicy",
+        PermissionsBoundaryArn: permissionsBoundaryArn,
+    };
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -56,4 +56,5 @@ export declare const simIamRoleWithPolicyFactory: AsyncMappedFactory<SimIamRoleW
     readonly CreateDate: Date;
     readonly AssumeRolePolicyDocument?: string | undefined;
     readonly Description?: string | undefined;
+    readonly PermissionsBoundary?: import("./sim-iam-role-boundary.js").SimIamAttachedPermissionsBoundary | undefined;
 }, SimAws>;

package/dist/service/iam/role/sim-iam-role.d.ts

@@ -19,6 +19,16 @@ export interface SimIamRole extends SimIamPrincipal {
     readonly assumeRolePolicyDocument?: JSONString<SimIamPolicyDocument> | undefined;
     readonly description?: string | undefined;
     readonly creationDate: Date;
+    /**
+     * ARN of the managed policy attached to this Role as its permissions
+     * boundary, where the request creating it declared one.
+     *
+     * This records what the Role was created with, so that a policy conditioned
+     * on `iam:PermissionsBoundary` can be tested against the Roles a deployment
+     * makes. The boundary is not yet evaluated as a policy source, so it does
+     * not narrow what the Role itself may do.
+     */
+    readonly permissionsBoundaryArn?: SimArn | undefined;
     /**
      * Inline identity-based permissions policies stored directly on this role.
      */

package/dist/service/iam/serve/sim-iam-query-entity.d.ts

@@ -7,5 +7,10 @@ import type { SimQueryOutput } from "../../../serve/http/api/query/sim-query-res
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[]): string;
+export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[], nested?: (entity: SimQueryOutput) => string): string;

package/dist/service/iam/serve/sim-iam-query-entity.js

@@ -12,10 +12,16 @@ import { xmlElement } from "../../../util/xml/xml-writer.js";
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export function iamQueryEntity(output, name, members) {
+export function iamQueryEntity(output, name, members, nested) {
     const entity = output[name];
-    return isRecord(entity)
-        ? xmlElement(name, queryMembers(entity, members))
-        : "";
+    if (!isRecord(entity)) {
+        return "";
+    }
+    return xmlElement(name, queryMembers(entity, members) + (nested?.(entity) ?? ""));
 }

package/dist/service/iam/serve/sim-iam-query-role-operations.js

@@ -1,4 +1,5 @@
-import { queryList, queryMembers, } from "../../../serve/http/api/query/sim-query-result.js";
+import { queryList, queryMembers, queryStructure, } from "../../../serve/http/api/query/sim-query-result.js";
+import { simIamAttachedBoundaryMembers } from "../role/sim-iam-role-boundary.js";
 import { iamQueryEntity } from "./sim-iam-query-entity.js";
 import { iamQueryListingInput, iamQueryListingResult, } from "./sim-iam-query-listing.js";
 /**
@@ -13,6 +14,16 @@ const roleMembers = [
     "AssumeRolePolicyDocument",
     "Description",
 ];
+/**
+ * Write the permissions boundary a Role carries, where it carries one.
+ *
+ * A boundary is a structure of its own, and `queryMembers` would write it as
+ * the JSON text of an object. `ListRoles` leaves the field out altogether, as
+ * IAM does, so only the create and the get pass this.
+ */
+function roleBoundary(role) {
+    return queryStructure(role, "PermissionsBoundary", (boundary) => queryMembers(boundary, simIamAttachedBoundaryMembers));
+}
 /**
  * The Role operations simulated IAM serves over the Query protocol.
  *
@@ -30,8 +41,9 @@ export function simIamQueryRoleOperations() {
                     Path: fields.text("Path"),
                     AssumeRolePolicyDocument: fields.text("AssumeRolePolicyDocument"),
                     Description: fields.text("Description"),
+                    PermissionsBoundary: fields.text("PermissionsBoundary"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [
@@ -40,7 +52,7 @@ export function simIamQueryRoleOperations() {
                 input: (fields) => ({
                     RoleName: fields.text("RoleName"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-properties.js

@@ -31,7 +31,7 @@ export class SimCfnLambdaEventSourceMappingProperties {
      */
     createInput() {
         const eventSourceArn = this.parser.requiredString(this.resource, this.properties["EventSourceArn"], "EventSourceArn");
-        assertSimulatedEventSourceMappingProperties(this.resource.logicalId, this.properties);
+        assertSimulatedEventSourceMappingProperties(this.resource, this.properties);
         return {
             EventSourceArn: eventSourceArn,
             FunctionName: simCfnLambdaTargetFunctionName(this.parser.requiredString(this.resource, this.properties["FunctionName"], "FunctionName")),

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 /**
  * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
@@ -11,6 +12,6 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 export declare function eventSourceMappingPropertyError(logicalId: string, reason: string): Error;
 /**
  * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated.
+ * not simulated, and record what the mapping is created without.
  */
-export declare function assertSimulatedEventSourceMappingProperties(logicalId: string, properties: SimCfnTemplateValueRecord): void;
+export declare function assertSimulatedEventSourceMappingProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.js

@@ -44,10 +44,26 @@ const unsimulatedPropertyNames = new Set([
     "SelfManagedEventSource",
     "SelfManagedKafkaEventSourceConfig",
     "SourceAccessConfigurations",
-    "Tags",
     "Topics",
     "TumblingWindowInSeconds",
 ]);
+/**
+ * Real AWS::Lambda::EventSourceMapping properties this simulation has nothing
+ * to act on and no reason to fail a stack over.
+ *
+ * `Tags` is the whole list. The mapping is created without them and the
+ * omission is recorded against the Resource. A mapping delivers the same
+ * records with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every mapping in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        "AWS::Lambda::EventSourceMapping property Tags is not simulated, so the " +
+            "mapping is created without them. Nothing reads them back and nothing " +
+            "is grouped or billed by them.",
+    ],
+]);
 /**
  * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
  * refused with.
@@ -62,10 +78,16 @@ export function eventSourceMappingPropertyError(logicalId, reason) {
 }
 /**
  * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated.
+ * not simulated, and record what the mapping is created without.
  */
-export function assertSimulatedEventSourceMappingProperties(logicalId, properties) {
+export function assertSimulatedEventSourceMappingProperties(resource, properties) {
+    const logicalId = resource.logicalId;
     for (const name of Object.keys(properties)) {
+        const ignoredReason = ignoredPropertyReasons.get(name);
+        if (ignoredReason !== undefined) {
+            resource.ignoreProperty(name, ignoredReason);
+            continue;
+        }
         if (unsimulatedPropertyNames.has(name)) {
             throw eventSourceMappingPropertyError(logicalId, `${name} is a real AWS::Lambda::EventSourceMapping property that ` +
                 "this simulation does not simulate, so it is refused rather than " +

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.d.ts

@@ -26,6 +26,12 @@ import type { SimCfnLambdaFunctionProperties } from "./sim-cfn-lambda-function-p
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export declare class SimCfnLambdaRuntimeSkip {
     /**

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.js

@@ -1,3 +1,4 @@
+import { SimCfnNamedSkip } from "../../../cloudformation/resource/unsupported/sim-cfn-named-skip.js";
 /**
  * Sim Lambda runs handler modules in a Node.js vm, so it simulates the
  * Node.js managed runtimes.
@@ -29,6 +30,12 @@ const nodeJsRuntimePrefix = "nodejs";
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export class SimCfnLambdaRuntimeSkip {
     /**
@@ -42,9 +49,9 @@ export class SimCfnLambdaRuntimeSkip {
             runtimeName.startsWith(nodeJsRuntimePrefix)) {
             return undefined;
         }
-        return new Error(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
+        return new SimCfnNamedSkip(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
             `sim Lambda simulates Node.js runtimes, and this function declares ` +
             `Runtime ${runtimeName}. Bind a real in-process handler to this ` +
-            `function to simulate it.`);
+            `function to simulate it.`, functionProperties.functionName);
     }
 }

package/dist/service/route53/command/create-hosted-zone/sim-route53-zone-id.js

@@ -34,10 +34,32 @@ export function makeSimRoute53HostedZoneId(existing = new Set()) {
 export function normalizeSimRoute53HostedZoneId(value) {
     const hostedZoneId = value?.replace(/^\/?hostedzone\//u, "");
     if (!isSimRoute53HostedZoneId(hostedZoneId)) {
-        throw new SimRoute53InvalidInput(`Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`);
+        throw new SimRoute53InvalidInput(rejectedSimRoute53HostedZoneId(value, hostedZoneId));
     }
     return hostedZoneId;
 }
+/**
+ * The literal CDK writes into a synthesized template when
+ * `HostedZone.fromLookup` runs against no credentials and no cached context.
+ */
+const cdkUnresolvedLookupHostedZoneId = "DUMMY";
+/**
+ * The message for a Hosted Zone ID that fails the shape check.
+ *
+ * CDK writes its unresolved lookup stand-in into every RecordSet of the
+ * synthesized template, and that value arrives here looking like any other
+ * malformed ID. Reporting it as one sends the reader to check an ID they never
+ * wrote, so the stand-in is named and the synth that produced it is pointed at.
+ */
+function rejectedSimRoute53HostedZoneId(value, hostedZoneId) {
+    const reported = `Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`;
+    if (hostedZoneId !== cdkUnresolvedLookupHostedZoneId) {
+        return reported;
+    }
+    return (`${reported}. CDK fills an unresolved \`HostedZone.fromLookup\` with this ` +
+        "stand-in. Run `cdk synth` with credentials for the account holding the " +
+        "zone, or commit the `cdk.context.json` a resolved lookup writes.");
+}
 /**
  * Whether a value has the shape of a Route53 Hosted Zone ID.
  */

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-creator.js

@@ -23,6 +23,7 @@ export class SimCfnSnsTopicCreator {
             resource,
             properties,
         });
+        topicProperties.recordIgnoredProperties();
         const name = topicProperties.name();
         const attributes = topicProperties.attributes();
         const inline = topicProperties.inlineSubscriptions();

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.d.ts

@@ -43,13 +43,18 @@ export declare class SimCfnSnsTopicProperties {
      * The subscriptions the topic declares inside itself.
      */
     inlineSubscriptions(): readonly SimCfnSnsInlineSubscription[];
+    /**
+     * Record the properties the topic is created without acting on.
+     */
+    recordIgnoredProperties(): void;
     /**
      * Whether a property is handed to CreateTopic as an attribute.
      *
-     * The two properties the CloudFormation layer reads itself are not. The rest
-     * are refused as they are reached: the ones with a reason of their own with
-     * that reason, and anything else as a property AWS::SNS::Topic does not have,
-     * which is how real CloudFormation answers one too.
+     * The two properties the CloudFormation layer reads itself are not, and
+     * neither are the ones recorded as ignored. The rest are refused as they are
+     * reached: the ones with a reason of their own with that reason, and
+     * anything else as a property AWS::SNS::Topic does not have, which is how
+     * real CloudFormation answers one too.
      */
     private isAttributeProperty;
     private propertyError;

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.js

@@ -3,7 +3,7 @@ import { simCfnSnsResourceError } from "../sim-cfn-sns-resource-error.js";
 import { snsTopicResourceType } from "../sim-cfn-sns-resource-types.js";
 import { simCfnSnsInlineSubscriptions, } from "./sim-cfn-sns-inline-subscriptions.js";
 import { SimCfnSnsTopicName } from "./sim-cfn-sns-topic-name.js";
-import { attributePropertyNames, topicNamePropertyName, topicSubscriptionPropertyName, unsimulatedPropertyReasons, } from "./sim-cfn-sns-topic-property-names.js";
+import { attributePropertyNames, ignoredPropertyReasons, topicNamePropertyName, topicSubscriptionPropertyName, unsimulatedPropertyReasons, } from "./sim-cfn-sns-topic-property-names.js";
 /**
  * Reads AWS::SNS::Topic CloudFormation properties into the shape CreateTopic
  * takes.
@@ -63,17 +63,29 @@ export class SimCfnSnsTopicProperties {
     inlineSubscriptions() {
         return simCfnSnsInlineSubscriptions(this.resource.logicalId, this.properties.get(topicSubscriptionPropertyName));
     }
+    /**
+     * Record the properties the topic is created without acting on.
+     */
+    recordIgnoredProperties() {
+        for (const [property, reason] of ignoredPropertyReasons) {
+            if (this.properties.has(property)) {
+                this.resource.ignoreProperty(property, reason);
+            }
+        }
+    }
     /**
      * Whether a property is handed to CreateTopic as an attribute.
      *
-     * The two properties the CloudFormation layer reads itself are not. The rest
-     * are refused as they are reached: the ones with a reason of their own with
-     * that reason, and anything else as a property AWS::SNS::Topic does not have,
-     * which is how real CloudFormation answers one too.
+     * The two properties the CloudFormation layer reads itself are not, and
+     * neither are the ones recorded as ignored. The rest are refused as they are
+     * reached: the ones with a reason of their own with that reason, and
+     * anything else as a property AWS::SNS::Topic does not have, which is how
+     * real CloudFormation answers one too.
      */
     isAttributeProperty(name) {
         if (name === topicNamePropertyName ||
-            name === topicSubscriptionPropertyName) {
+            name === topicSubscriptionPropertyName ||
+            ignoredPropertyReasons.has(name)) {
             return false;
         }
         if (attributePropertyNames.has(name)) {