@kensio/yulin 1.21.6 → 1.21.8

package/README.md

@@ -66,6 +66,7 @@ npm i -D @kensio/yulin
 - [Non-AWS dependencies](https://yulinsim.dev/non-aws-dependencies/ "Dependencies Yulin does not simulate docs")
 - [Serving on localhost](https://yulinsim.dev/serve/ "Serving simulated AWS on localhost docs")
 - [Simulated time](https://yulinsim.dev/time/ "Simulated time docs")
+- [Test suite setup](https://yulinsim.dev/testing/ "Sharing one Yulin environment across a test suite")
 - [Terraform](https://yulinsim.dev/terraform/ "Deploying Terraform into simulated AWS docs")
 
 Every page listed above also ships inside the package as markdown, documenting the version
@@ -74,6 +75,24 @@ reach can read them from there.
 
 ## Usage
 
+### Set up Yulin once for the test suite
+
+An application test suite should normally create one Yulin environment in its Vitest setup. Install
+SDK interception and deploy the application's simulated infrastructure there, then let every test
+use that state. Treat the environment like an AWS account or a LocalStack container that belongs to
+the suite.
+
+Keep tests independent by giving their records and resources unique names. A fresh `SimAws` or
+`SimSdk` for every test or test file is supported, but it is intended for cases that specifically
+need an empty simulated account.
+
+The simulated clock is shared too. Most tests should leave it alone and use the suite environment.
+Put tests that call `freeze()`, `setTo(...)`, `advanceBy(...)`, or `resume()` in a separate group with
+a fresh Yulin environment for each test.
+
+The [test suite setup guide](https://yulinsim.dev/testing/ "Sharing one Yulin environment across a test suite")
+shows the Vitest configuration, shared deployment, and SDK interception.
+
 ### Intercept AWS SDK clients
 
 If your code uses the AWS SDK, you can intercept its clients and route their Commands to simulated
@@ -166,8 +185,9 @@ const accountId = simAwsAccountId("111111111111");
 const someOtherAccountId = makeSimAwsAccountId();
 ```
 
-Each instance of `SimAws` is cheap and encapsulated. Make one wherever you need it, in every test
-case or in shared test setup, whichever suits.
+Each instance of `SimAws` is encapsulated. Application tests should usually share one instance from
+suite setup. Create another instance when a test needs a separate simulated account with no shared
+state.
 
 If you prefer, you can also instantiate simulated services individually:
 

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-creator.js

@@ -24,6 +24,7 @@ export class SimCfnEventBusCreator {
             properties,
         });
         busProperties.refuseUnsimulated();
+        busProperties.recordIgnoredProperties();
         const name = busProperties.name();
         const description = busProperties.description();
         return await simCfnEventBridgeResourceCreation(eventBusResourceType, resource.logicalId, async () => {

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-properties.d.ts

@@ -27,6 +27,10 @@ export declare class SimCfnEventBusProperties {
      * Refuse what this simulation does not model, naming the property.
      */
     refuseUnsimulated(): void;
+    /**
+     * Record the properties the bus is created without acting on.
+     */
+    recordIgnoredProperties(): void;
     private propertyError;
 }
 export {};

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-properties.js

@@ -19,8 +19,23 @@ const unsimulatedProperties = [
     ["EventSourceName", "partner event buses are not simulated"],
     ["KmsKeyIdentifier", "events are not encrypted with a customer managed key"],
     ["LogConfig", "event bus logging is not simulated"],
-    ["Tags", "event bus tags are not simulated"],
 ];
+/**
+ * What a template can say about an event bus that this simulation has nothing
+ * to act on, and why.
+ *
+ * `Tags` is the whole list, and it is recorded rather than refused. A bus
+ * behaves the same way with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every bus in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        `${eventBusResourceType} property Tags is not simulated, so the bus is ` +
+            "created without them. Nothing reads them back and nothing is grouped " +
+            "or billed by them.",
+    ],
+]);
 /**
  * Reads AWS::Events::EventBus properties into the shape CreateEventBus takes.
  */
@@ -71,6 +86,16 @@ export class SimCfnEventBusProperties {
             }
         }
     }
+    /**
+     * Record the properties the bus is created without acting on.
+     */
+    recordIgnoredProperties() {
+        for (const [property, reason] of ignoredPropertyReasons) {
+            if (this.properties.has(property)) {
+                this.resource.ignoreProperty(property, reason);
+            }
+        }
+    }
     propertyError(reason) {
         return simCfnEventBridgeResourceError(eventBusResourceType, this.resource.logicalId, reason);
     }

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.js

@@ -2,6 +2,7 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnEventBridgeResourceCreation } from "../sim-cfn-event-bridge-resource-error.js";
 import { eventRuleResourceType } from "../sim-cfn-event-bridge-resource-types.js";
 import { SimCfnEventRuleProperties } from "./sim-cfn-event-rule-properties.js";
+import { recordIgnoredEventRuleProperties, refuseUnsimulatedEventRuleProperties, } from "./sim-cfn-event-rule-unsimulated-properties.js";
 /**
  * Creates simulated rules from AWS::Events::Rule Resources.
  *
@@ -27,7 +28,8 @@ export class SimCfnEventRuleCreator {
             resource,
             properties,
         });
-        ruleProperties.refuseUnsimulated();
+        refuseUnsimulatedEventRuleProperties(resource, properties);
+        recordIgnoredEventRuleProperties(resource, properties);
         const name = ruleProperties.name();
         const busName = ruleProperties.busName();
         const targets = ruleProperties.targets();

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-properties.d.ts

@@ -48,13 +48,6 @@ export declare class SimCfnEventRuleProperties {
      * The rule's inline targets.
      */
     targets(): readonly SimCfnEventRuleTarget[];
-    /**
-     * Refuse what this simulation does not model, naming the property.
-     *
-     * Both are asked by key rather than by value, so a template writing `null`
-     * for one is refused rather than read as having left it out.
-     */
-    refuseUnsimulated(): void;
     private stringProperty;
     private propertyError;
 }

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-properties.js

@@ -89,26 +89,6 @@ export class SimCfnEventRuleProperties {
     targets() {
         return simCfnEventRuleTargets(this.properties.get("Targets"), (reason) => this.propertyError(reason));
     }
-    /**
-     * Refuse what this simulation does not model, naming the property.
-     *
-     * Both are asked by key rather than by value, so a template writing `null`
-     * for one is refused rather than read as having left it out.
-     */
-    refuseUnsimulated() {
-        if (this.properties.has("RoleArn")) {
-            throw this.propertyError("RoleArn is not simulated, so the Resource is refused rather than " +
-                "deployed without it: a rule reaches its target as the EventBridge " +
-                "service principal, admitted by the target's own resource policy");
-        }
-        // Rule tags never reach PutRule, which is the one place that would
-        // otherwise refuse them, so a tagged rule would deploy and quietly lose
-        // its tags.
-        if (this.properties.has("Tags")) {
-            throw this.propertyError("Tags are not simulated, so the Resource is refused rather than " +
-                "deployed without them");
-        }
-    }
     stringProperty(name) {
         const value = this.properties.get(name);
         if (value === undefined) {

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-unsimulated-properties.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Refuse what this simulation does not model, naming the property.
+ *
+ * Asked by key rather than by value, so a template writing `null` for one of
+ * these is refused rather than read as having left it out.
+ */
+export declare function refuseUnsimulatedEventRuleProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;
+/**
+ * Record the properties the rule is created without acting on.
+ */
+export declare function recordIgnoredEventRuleProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-unsimulated-properties.js

@@ -0,0 +1,59 @@
+import { simCfnEventBridgeResourceError } from "../sim-cfn-event-bridge-resource-error.js";
+import { eventRuleResourceType } from "../sim-cfn-event-bridge-resource-types.js";
+/**
+ * What a template can say about a rule that this simulation does not model,
+ * and why each one fails the Resource.
+ *
+ * `RoleArn` is the whole list. A rule reaches its target as the EventBridge
+ * service principal, admitted by the target's own resource policy, so a rule
+ * deployed with a role would sit in a test looking as though the role decided
+ * something.
+ */
+const refusedPropertyReasons = new Map([
+    [
+        "RoleArn",
+        "RoleArn is not simulated, so the Resource is refused rather than " +
+            "deployed without it: a rule reaches its target as the EventBridge " +
+            "service principal, admitted by the target's own resource policy",
+    ],
+]);
+/**
+ * What a template can say about a rule that this simulation has nothing to act
+ * on, and why each one is recorded rather than refused.
+ *
+ * `Tags` is the whole list. Rule tags never reach `PutRule`, so the record is
+ * the only place a tagged rule says it lost them. A rule routes the same
+ * events with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every rule in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        `${eventRuleResourceType} property Tags is not simulated, so the rule is ` +
+            "created without them. Nothing reads them back and nothing is grouped " +
+            "or billed by them.",
+    ],
+]);
+/**
+ * Refuse what this simulation does not model, naming the property.
+ *
+ * Asked by key rather than by value, so a template writing `null` for one of
+ * these is refused rather than read as having left it out.
+ */
+export function refuseUnsimulatedEventRuleProperties(resource, properties) {
+    for (const [property, reason] of refusedPropertyReasons) {
+        if (Object.hasOwn(properties, property)) {
+            throw simCfnEventBridgeResourceError(eventRuleResourceType, resource.logicalId, reason);
+        }
+    }
+}
+/**
+ * Record the properties the rule is created without acting on.
+ */
+export function recordIgnoredEventRuleProperties(resource, properties) {
+    for (const [property, reason] of ignoredPropertyReasons) {
+        if (Object.hasOwn(properties, property)) {
+            resource.ignoreProperty(property, reason);
+        }
+    }
+}

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-error.d.ts

@@ -15,7 +15,7 @@ export declare function simCfnEventBridgeResourceError(resourceType: string, log
  * Every Resource type here goes through the ordinary EventBridge commands, so
  * what a template may ask for is decided once, by simulated EventBridge, rather
  * than again in the CloudFormation layer. What that leaves out is where the
- * request came from: a deployment failing with `Rule tags are not simulated`
+ * request came from: a deployment failing with `Rule pattern is not valid`
  * says nothing about which Resource asked for it. Only EventBridge's own errors
  * are renamed, so a refusal the CloudFormation layer decided keeps the wording
  * it was written with.

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-error.js

@@ -20,7 +20,7 @@ export function simCfnEventBridgeResourceError(resourceType, logicalId, reason,
  * Every Resource type here goes through the ordinary EventBridge commands, so
  * what a template may ask for is decided once, by simulated EventBridge, rather
  * than again in the CloudFormation layer. What that leaves out is where the
- * request came from: a deployment failing with `Rule tags are not simulated`
+ * request came from: a deployment failing with `Rule pattern is not valid`
  * says nothing about which Resource asked for it. Only EventBridge's own errors
  * are renamed, so a refusal the CloudFormation layer decided keeps the wording
  * it was written with.

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-properties.js

@@ -31,7 +31,7 @@ export class SimCfnLambdaEventSourceMappingProperties {
      */
     createInput() {
         const eventSourceArn = this.parser.requiredString(this.resource, this.properties["EventSourceArn"], "EventSourceArn");
-        assertSimulatedEventSourceMappingProperties(this.resource.logicalId, this.properties);
+        assertSimulatedEventSourceMappingProperties(this.resource, this.properties);
         return {
             EventSourceArn: eventSourceArn,
             FunctionName: simCfnLambdaTargetFunctionName(this.parser.requiredString(this.resource, this.properties["FunctionName"], "FunctionName")),

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 /**
  * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
@@ -11,6 +12,6 @@ import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template
 export declare function eventSourceMappingPropertyError(logicalId: string, reason: string): Error;
 /**
  * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated.
+ * not simulated, and record what the mapping is created without.
  */
-export declare function assertSimulatedEventSourceMappingProperties(logicalId: string, properties: SimCfnTemplateValueRecord): void;
+export declare function assertSimulatedEventSourceMappingProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;

package/dist/service/lambda/cfn/event-source-mapping/sim-cfn-lambda-event-source-mapping-property-rules.js

@@ -44,10 +44,26 @@ const unsimulatedPropertyNames = new Set([
     "SelfManagedEventSource",
     "SelfManagedKafkaEventSourceConfig",
     "SourceAccessConfigurations",
-    "Tags",
     "Topics",
     "TumblingWindowInSeconds",
 ]);
+/**
+ * Real AWS::Lambda::EventSourceMapping properties this simulation has nothing
+ * to act on and no reason to fail a stack over.
+ *
+ * `Tags` is the whole list. The mapping is created without them and the
+ * omission is recorded against the Resource. A mapping delivers the same
+ * records with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every mapping in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        "AWS::Lambda::EventSourceMapping property Tags is not simulated, so the " +
+            "mapping is created without them. Nothing reads them back and nothing " +
+            "is grouped or billed by them.",
+    ],
+]);
 /**
  * Build the error a property of an AWS::Lambda::EventSourceMapping Resource is
  * refused with.
@@ -62,10 +78,16 @@ export function eventSourceMappingPropertyError(logicalId, reason) {
 }
 /**
  * Refuse everything about an AWS::Lambda::EventSourceMapping Resource that is
- * not simulated.
+ * not simulated, and record what the mapping is created without.
  */
-export function assertSimulatedEventSourceMappingProperties(logicalId, properties) {
+export function assertSimulatedEventSourceMappingProperties(resource, properties) {
+    const logicalId = resource.logicalId;
     for (const name of Object.keys(properties)) {
+        const ignoredReason = ignoredPropertyReasons.get(name);
+        if (ignoredReason !== undefined) {
+            resource.ignoreProperty(name, ignoredReason);
+            continue;
+        }
         if (unsimulatedPropertyNames.has(name)) {
             throw eventSourceMappingPropertyError(logicalId, `${name} is a real AWS::Lambda::EventSourceMapping property that ` +
                 "this simulation does not simulate, so it is refused rather than " +

package/dist/service/ses/command/authorize/sim-ses-authorizer.d.ts

@@ -30,6 +30,15 @@ export declare class SimSesAuthorizer {
      * ARN the identity is about to have.
      */
     authorizeIdentity(action: string, emailIdentity: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may send from one email identity and address.
+     *
+     * SES supplies the bare sender address as `ses:FromAddress`. A policy can
+     * use this key to grant one address under a verified domain identity.
+     *
+     * https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-policy-examples.html#sending-authorization-policy-example-from
+     */
+    authorizeSendEmail(emailIdentity: string, fromAddress: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
     /**
      * Ensure the caller may perform an action on one email template.
      *

package/dist/service/ses/command/authorize/sim-ses-authorizer.js

@@ -40,6 +40,17 @@ export class SimSesAuthorizer {
     authorizeIdentity(action, emailIdentity, caller) {
         return this.authorizeResource(action, simSesIdentityArn(this.#accountRegionScope, emailIdentity), caller);
     }
+    /**
+     * Ensure the caller may send from one email identity and address.
+     *
+     * SES supplies the bare sender address as `ses:FromAddress`. A policy can
+     * use this key to grant one address under a verified domain identity.
+     *
+     * https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-policy-examples.html#sending-authorization-policy-example-from
+     */
+    authorizeSendEmail(emailIdentity, fromAddress, caller) {
+        return this.authorizeResource("ses:SendEmail", simSesIdentityArn(this.#accountRegionScope, emailIdentity), caller, { "ses:FromAddress": fromAddress });
+    }
     /**
      * Ensure the caller may perform an action on one email template.
      *
@@ -73,8 +84,13 @@ export class SimSesAuthorizer {
     authorizeNoResource(action, caller) {
         return this.authorizeResource(action, noResource, caller);
     }
-    authorizeResource(action, resource, caller) {
-        const decision = this.#iam.authorize({ action, resource, caller });
+    authorizeResource(action, resource, caller, conditionContext) {
+        const decision = this.#iam.authorize({
+            action,
+            resource,
+            caller,
+            conditionContext,
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,

package/dist/service/ses/command/send/sim-ses-send-email.js

@@ -42,8 +42,9 @@ export class SimSesSendEmail {
     handle(command, options) {
         const input = command.input;
         const fromEmailAddress = requiredSimSesFromAddress(input.FromEmailAddress);
+        const bareFromAddress = simSesBareAddress(fromEmailAddress);
         refuseUnsimulatedSendInput(input);
-        this.#authorizer.authorizeIdentity("ses:SendEmail", this.#identities.covering(simSesBareAddress(fromEmailAddress)), options?.caller);
+        this.#authorizer.authorizeSendEmail(this.#identities.covering(bareFromAddress), bareFromAddress, options?.caller);
         const destination = readDestination(input.Destination);
         const recipients = allRecipients(destination);
         if (recipients.length === 0) {

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-creator.js

@@ -23,6 +23,7 @@ export class SimCfnSnsTopicCreator {
             resource,
             properties,
         });
+        topicProperties.recordIgnoredProperties();
         const name = topicProperties.name();
         const attributes = topicProperties.attributes();
         const inline = topicProperties.inlineSubscriptions();

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.d.ts

@@ -43,13 +43,18 @@ export declare class SimCfnSnsTopicProperties {
      * The subscriptions the topic declares inside itself.
      */
     inlineSubscriptions(): readonly SimCfnSnsInlineSubscription[];
+    /**
+     * Record the properties the topic is created without acting on.
+     */
+    recordIgnoredProperties(): void;
     /**
      * Whether a property is handed to CreateTopic as an attribute.
      *
-     * The two properties the CloudFormation layer reads itself are not. The rest
-     * are refused as they are reached: the ones with a reason of their own with
-     * that reason, and anything else as a property AWS::SNS::Topic does not have,
-     * which is how real CloudFormation answers one too.
+     * The two properties the CloudFormation layer reads itself are not, and
+     * neither are the ones recorded as ignored. The rest are refused as they are
+     * reached: the ones with a reason of their own with that reason, and
+     * anything else as a property AWS::SNS::Topic does not have, which is how
+     * real CloudFormation answers one too.
      */
     private isAttributeProperty;
     private propertyError;

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.js

@@ -3,7 +3,7 @@ import { simCfnSnsResourceError } from "../sim-cfn-sns-resource-error.js";
 import { snsTopicResourceType } from "../sim-cfn-sns-resource-types.js";
 import { simCfnSnsInlineSubscriptions, } from "./sim-cfn-sns-inline-subscriptions.js";
 import { SimCfnSnsTopicName } from "./sim-cfn-sns-topic-name.js";
-import { attributePropertyNames, topicNamePropertyName, topicSubscriptionPropertyName, unsimulatedPropertyReasons, } from "./sim-cfn-sns-topic-property-names.js";
+import { attributePropertyNames, ignoredPropertyReasons, topicNamePropertyName, topicSubscriptionPropertyName, unsimulatedPropertyReasons, } from "./sim-cfn-sns-topic-property-names.js";
 /**
  * Reads AWS::SNS::Topic CloudFormation properties into the shape CreateTopic
  * takes.
@@ -63,17 +63,29 @@ export class SimCfnSnsTopicProperties {
     inlineSubscriptions() {
         return simCfnSnsInlineSubscriptions(this.resource.logicalId, this.properties.get(topicSubscriptionPropertyName));
     }
+    /**
+     * Record the properties the topic is created without acting on.
+     */
+    recordIgnoredProperties() {
+        for (const [property, reason] of ignoredPropertyReasons) {
+            if (this.properties.has(property)) {
+                this.resource.ignoreProperty(property, reason);
+            }
+        }
+    }
     /**
      * Whether a property is handed to CreateTopic as an attribute.
      *
-     * The two properties the CloudFormation layer reads itself are not. The rest
-     * are refused as they are reached: the ones with a reason of their own with
-     * that reason, and anything else as a property AWS::SNS::Topic does not have,
-     * which is how real CloudFormation answers one too.
+     * The two properties the CloudFormation layer reads itself are not, and
+     * neither are the ones recorded as ignored. The rest are refused as they are
+     * reached: the ones with a reason of their own with that reason, and
+     * anything else as a property AWS::SNS::Topic does not have, which is how
+     * real CloudFormation answers one too.
      */
     isAttributeProperty(name) {
         if (name === topicNamePropertyName ||
-            name === topicSubscriptionPropertyName) {
+            name === topicSubscriptionPropertyName ||
+            ignoredPropertyReasons.has(name)) {
             return false;
         }
         if (attributePropertyNames.has(name)) {

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.d.ts

@@ -28,3 +28,13 @@ export declare const attributePropertyNames: ReadonlySet<string>;
  * become fifteen separate attributes.
  */
 export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+/**
+ * The real AWS::SNS::Topic properties this simulation has nothing to act on
+ * and no reason to fail a stack over.
+ *
+ * `Tags` is the whole list. The topic is created without them and the omission
+ * is recorded against the Resource. A topic behaves the same way with a tag
+ * and without one, and a CDK app calling `Tags.of(app).add(...)` tags every
+ * topic in it.
+ */
+export declare const ignoredPropertyReasons: ReadonlyMap<string, string>;

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.js

@@ -47,5 +47,20 @@ export const unsimulatedPropertyReasons = new Map([
         "DeliveryStatusLogging",
         "delivery status logging writes to CloudWatch Logs, which is not simulated",
     ],
-    ["Tags", "no simulated service reads a topic tag"],
+]);
+/**
+ * The real AWS::SNS::Topic properties this simulation has nothing to act on
+ * and no reason to fail a stack over.
+ *
+ * `Tags` is the whole list. The topic is created without them and the omission
+ * is recorded against the Resource. A topic behaves the same way with a tag
+ * and without one, and a CDK app calling `Tags.of(app).add(...)` tags every
+ * topic in it.
+ */
+export const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        "AWS::SNS::Topic property Tags is not simulated, so the topic is created " +
+            "without them. No simulated service reads a topic tag.",
+    ],
 ]);

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.js

@@ -28,6 +28,7 @@ export class SimCfnSsmParameterCreator {
             properties,
         });
         const name = parameterProperties.name();
+        parameterProperties.recordIgnoredTags();
         await this.ssm.putParameter({
             input: {
                 Name: name,
@@ -38,7 +39,6 @@ export class SimCfnSsmParameterCreator {
                 AllowedPattern: parameterProperties.allowedPattern(),
                 DataType: parameterProperties.dataType(),
                 Policies: parameterProperties.policies(),
-                Tags: parameterProperties.tags(),
             },
         }, options);
         const parameter = this.ssm.findParameter(name);

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.d.ts

@@ -1,6 +1,5 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
-import type { SimSsmTag } from "../../command/parameter/parameter.command.js";
 interface SimCfnSsmParameterPropertiesProperties {
     readonly resource: SimCfnResource;
     readonly properties: SimCfnTemplateValueRecord;
@@ -60,13 +59,19 @@ export declare class SimCfnSsmParameterProperties {
      */
     policies(): string | undefined;
     /**
-     * The parameter Tags, which PutParameter refuses.
+     * Record the tags the parameter is written without.
      *
-     * CloudFormation carries these as a map of names to values for this
-     * Resource type, rather than the list of Key/Value pairs most Resource
-     * types use, so they are turned into the list shape PutParameter takes.
+     * `Tags` is the one difference from `PutParameter`, which refuses it
+     * outright. A template's tags are usually the whole stack's, and a CDK app
+     * calling `Tags.of(app).add(...)` tags every parameter in it. The parameter
+     * holds the same value either way, so the deploy stands and the omission is
+     * recorded.
+     *
+     * The shape is still read, because CloudFormation carries these as a map of
+     * names to values for this Resource type and a template AWS refuses should
+     * not deploy here.
      */
-    tags(): readonly SimSsmTag[] | undefined;
+    recordIgnoredTags(): void;
     private string;
     private stringValue;
     private propertyError;

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-properties.js

@@ -88,23 +88,32 @@ export class SimCfnSsmParameterProperties {
         return this.string(this.properties["Policies"], "Policies");
     }
     /**
-     * The parameter Tags, which PutParameter refuses.
+     * Record the tags the parameter is written without.
      *
-     * CloudFormation carries these as a map of names to values for this
-     * Resource type, rather than the list of Key/Value pairs most Resource
-     * types use, so they are turned into the list shape PutParameter takes.
+     * `Tags` is the one difference from `PutParameter`, which refuses it
+     * outright. A template's tags are usually the whole stack's, and a CDK app
+     * calling `Tags.of(app).add(...)` tags every parameter in it. The parameter
+     * holds the same value either way, so the deploy stands and the omission is
+     * recorded.
+     *
+     * The shape is still read, because CloudFormation carries these as a map of
+     * names to values for this Resource type and a template AWS refuses should
+     * not deploy here.
      */
-    tags() {
+    recordIgnoredTags() {
         const tags = this.properties["Tags"];
         if (tags === undefined) {
-            return undefined;
+            return;
         }
         if (typeof tags !== "object" || tags === null || Array.isArray(tags)) {
             throw this.propertyError("Tags must be an object");
         }
-        return Object.entries(tags).map(([key, value]) => {
-            return { Key: key, Value: this.stringValue(value, `Tags.${key}`) };
-        });
+        for (const [key, value] of Object.entries(tags)) {
+            this.stringValue(value, `Tags.${key}`);
+        }
+        this.resource.ignoreProperty("Tags", "AWS::SSM::Parameter property Tags is not simulated, so the parameter " +
+            "is written without them. Nothing reads them back and no " +
+            "aws:ResourceTag condition key matches them.");
     }
     string(value, name) {
         if (value === undefined) {