@kensio/yulin 1.22.0 → 1.23.1

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.d.ts

@@ -3,16 +3,19 @@ import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.t
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export declare const simWafIpReputationList: SimWafManagedRuleGroupDefinition;
 /**
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export declare const simWafAnonymousIpList: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.js

@@ -2,15 +2,17 @@
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export const simWafIpReputationList = {
     name: "AWSManagedRulesAmazonIpReputationList",
     labelNamespace: "awswaf:managed:aws:amazon-ip-list",
     capacity: 25,
+    readsSourceAddress: true,
     rules: [
         {
             name: "AWSManagedIPReputationList",
@@ -34,12 +36,15 @@ export const simWafIpReputationList = {
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export const simWafAnonymousIpList = {
     name: "AWSManagedRulesAnonymousIpList",
     labelNamespace: "awswaf:managed:aws:anonymous-ip-list",
     capacity: 50,
+    readsSourceAddress: true,
     rules: [
         { name: "AnonymousIPList", label: "AnonymousIPList", tier: "declared" },
         {

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.d.ts

@@ -0,0 +1,32 @@
+import type { SimWafDeclared } from "./sim-waf-managed-declaration.js";
+/**
+ * The managed rules a test says flag the requests from some addresses.
+ */
+export interface SimWafManagedAddressDeclaration {
+    /**
+     * The rules that flag the addresses, by the name AWS gives them, such as
+     * `AnonymousIPList` or `HostingProviderIPList`.
+     */
+    readonly matches: readonly string[];
+}
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export declare class SimWafDeclaredAddresses {
+    #private;
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range: string, ruleNames: readonly string[]): void;
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared: SimWafDeclared, sourceIp: string): SimWafDeclared;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.js

@@ -0,0 +1,52 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+import { SimWafDeclaredAddressRange } from "./sim-waf-managed-address-range.js";
+import { requiredSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export class SimWafDeclaredAddresses {
+    #byRange = new Map();
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range, ruleNames) {
+        const matches = new Set(ruleNames.map((name) => simWafAddressRuleName(requiredSimWafManagedRule(name))));
+        this.#byRange.set(range.trim(), SimWafDeclaredAddressRange.read(range, matches));
+    }
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared, sourceIp) {
+        const byAddress = this.#byRange
+            .values()
+            .filter((range) => range.holds(sourceIp))
+            .flatMap((range) => range.matches)
+            .toArray();
+        if (byAddress.length === 0) {
+            return declared;
+        }
+        return {
+            matches: new Set([...declared.matches, ...byAddress]),
+            groupLabels: declared.groupLabels,
+        };
+    }
+}
+/**
+ * The name of a rule a test may declare by address, refusing one whose group
+ * reads the request rather than where it came from.
+ */
+function simWafAddressRuleName(entry) {
+    if (entry.group.readsSourceAddress !== true) {
+        throw new SimWafDeclarationError(`${entry.rule.name} belongs to ${entry.group.name}, which does not ` +
+            `decide by the client address, so a match for it is declared by path ` +
+            `with managedRules().onRequest rather than by address.`);
+    }
+    return entry.rule.name;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export declare class SimWafDeclaredAddressRange {
+    #private;
+    readonly matches: ReadonlySet<string>;
+    private constructor();
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range: string, matches: ReadonlySet<string>): SimWafDeclaredAddressRange;
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp: string): boolean;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.js

@@ -0,0 +1,73 @@
+import { BlockList, isIP } from "node:net";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export class SimWafDeclaredAddressRange {
+    matches;
+    #addresses = new BlockList();
+    constructor(range, matches) {
+        this.matches = matches;
+        if (range.prefix === undefined) {
+            this.#addresses.addAddress(range.address, range.family);
+        }
+        else {
+            this.#addresses.addSubnet(range.address, range.prefix, range.family);
+        }
+    }
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range, matches) {
+        return new SimWafDeclaredAddressRange(checkedRange(range), matches);
+    }
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp) {
+        const family = familyOf(sourceIp);
+        return family !== undefined && this.#addresses.check(sourceIp, family);
+    }
+}
+/**
+ * Read an address or a CIDR range into the address, the prefix length and the
+ * family.
+ */
+function checkedRange(range) {
+    const [address = "", prefixText, ...rest] = range.trim().split("/");
+    const family = familyOf(address);
+    if (family === undefined || rest.length > 0) {
+        throw invalidRange(range);
+    }
+    if (prefixText === undefined) {
+        return { address, prefix: undefined, family };
+    }
+    const prefix = Number(prefixText);
+    const widest = family === "ipv4" ? 32 : 128;
+    if (!/^\d+$/u.test(prefixText) || prefix > widest) {
+        throw invalidRange(range);
+    }
+    return { address, prefix, family };
+}
+function familyOf(address) {
+    switch (isIP(address)) {
+        case 4: {
+            return "ipv4";
+        }
+        case 6: {
+            return "ipv6";
+        }
+        default: {
+            return undefined;
+        }
+    }
+}
+function invalidRange(range) {
+    return new SimWafDeclarationError(`A declared address match needs one IPv4 or IPv6 address, or a CIDR ` +
+        `range such as 185.220.101.0/24, and ${range} is neither`);
+}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts

@@ -30,6 +30,13 @@ export declare function simWafManagedRuleGroupNames(): readonly string[];
  * declared match and an action override name a rule and nothing else.
  */
 export declare function findSimWafManagedRule(name: string): SimWafManagedRuleEntry | undefined;
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export declare function requiredSimWafManagedRule(name: string): SimWafManagedRuleEntry;
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js

@@ -1,3 +1,4 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafAdminProtectionRuleSet } from "./group/sim-waf-admin-protection.js";
 import { simWafBotControlRuleSet } from "./group/sim-waf-bot-control.js";
 import { simWafCommonRuleSet } from "./group/sim-waf-common-rule-set.js";
@@ -45,6 +46,20 @@ export function simWafManagedRuleGroupNames() {
 export function findSimWafManagedRule(name) {
     return rulesByName.get(name);
 }
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export function requiredSimWafManagedRule(name) {
+    const entry = rulesByName.get(name);
+    if (entry === undefined) {
+        throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ${name}. The ` +
+            `rules that are simulated are reported by managedRules().rules().`);
+    }
+    return entry;
+}
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -52,5 +52,10 @@ export interface SimWafManagedRuleGroupDefinition {
     readonly labelNamespace: string;
     /** The WCUs the group costs, which `DescribeManagedRuleGroup` reports. */
     readonly capacity: number;
+    /**
+     * Whether the group decides by the client address alone, which is what lets
+     * a test declare its matches by address with `managedRules().onAddress`.
+     */
+    readonly readsSourceAddress?: boolean | undefined;
     readonly rules: readonly SimWafManagedRuleDefinition[];
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -1,8 +1,10 @@
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
 import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+import { type SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 import { type SimWafDeclared, type SimWafManagedMatchDeclaration } from "./sim-waf-managed-declaration.js";
 export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-managed-declaration.js";
+export type { SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
  * covers of each rule.
@@ -28,6 +30,16 @@ export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-m
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
@@ -42,9 +54,24 @@ export declare class SimWafManagedRules {
      * is refused here rather than matching nothing later.
      */
     onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range: string, declaration: SimWafManagedAddressDeclaration): void;
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request: SimWafInspectedRequest): SimWafDeclared;
     /**
@@ -59,5 +86,4 @@ export declare class SimWafManagedRules {
      * AWS rule they stand for.
      */
     rules(): readonly SimWafManagedRuleReport[];
-    private requiredRule;
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.js

@@ -1,6 +1,7 @@
 import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
-import { findSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+import { requiredSimWafManagedRule } from "./sim-waf-managed-rule-groups.js";
 import { simWafManagedRuleReports, } from "./sim-waf-managed-rule-report.js";
+import { SimWafDeclaredAddresses, } from "./sim-waf-managed-address-declaration.js";
 import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
@@ -27,12 +28,23 @@ import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
  */
 export class SimWafManagedRules {
     #byUriPath = new Map();
+    #byAddress = new SimWafDeclaredAddresses();
     /**
      * Declare which managed rules claim a request to one URI path.
      *
@@ -45,20 +57,37 @@ export class SimWafManagedRules {
             throw new SimWafDeclarationError("A declared managed rule match needs the URI path of the request it " +
                 "is declared for");
         }
-        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => this.requiredRule(name).rule.name));
+        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => requiredSimWafManagedRule(name).rule.name));
+    }
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range, declaration) {
+        this.#byAddress.declare(range, declaration.matches);
     }
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request) {
-        return this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared;
+        return this.#byAddress.joinedWith(this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared, request.sourceIp);
     }
     /**
      * What this simulation covers of one managed rule.
      */
     tierOf(ruleName) {
-        return this.requiredRule(ruleName).rule.tier;
+        return requiredSimWafManagedRule(ruleName).rule.tier;
     }
     /**
      * What this simulation covers of every managed rule it carries.
@@ -70,13 +99,4 @@ export class SimWafManagedRules {
     rules() {
         return simWafManagedRuleReports();
     }
-    requiredRule(ruleName) {
-        const entry = findSimWafManagedRule(ruleName);
-        if (entry === undefined) {
-            throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ` +
-                `${ruleName}. The rules that are simulated are reported by ` +
-                `managedRules().rules().`);
-        }
-        return entry;
-    }
 }

package/dist/service/wafv2/sim-wafv2.js

@@ -98,7 +98,8 @@ export class SimWafV2 extends SimWafSets {
     evaluateRequest(evaluation) {
         const webAcl = this.requireWebAcl(evaluation.webAclArn);
         const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
-        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
+        const { request, body, sourceIp } = evaluation;
+        return webAcl.evaluate(simWafInspectedRequest(request, body, limitBytes, sourceIp));
     }
     /**
      * What the AWS managed rule groups do here, and what a test declares of

package/dist/service/wafv2/statement/sim-waf-rate-based-input.d.ts

@@ -36,10 +36,11 @@ export declare function simWafRateWindowMilliseconds(statement: SimWafRateBasedS
 /**
  * Read how a rate-based statement groups the requests it counts.
  *
- * `IP` counts each client address on its own. Every request in this simulation
- * reports `simAwsProxiedSourceIp`, leaving one client for the whole
- * simulation. A rate limiting test sends its requests from one client and
- * expects the rule to trip, so that is the case anybody would write.
+ * `IP` counts each client address on its own. A request comes from
+ * `127.0.0.1` unless it states another address with `x-sim-aws-source-ip`, so
+ * a test that states none has one client for the whole simulation. That is
+ * the case a rate limiting test is usually written about: one client, sending
+ * until the rule trips.
  *
  * `CONSTANT` counts every request the statement sees together, and AWS asks
  * for a scope-down statement alongside it to say which requests those are. A

package/dist/service/wafv2/statement/sim-waf-rate-based-input.js

@@ -1,4 +1,3 @@
-import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
 import { refuseUnsimulatedSimWafRateKeyType } from "./sim-waf-unsimulated-rate-based.js";
 /**
@@ -66,10 +65,11 @@ export function simWafRateWindowMilliseconds(statement, ruleName) {
 /**
  * Read how a rate-based statement groups the requests it counts.
  *
- * `IP` counts each client address on its own. Every request in this simulation
- * reports `simAwsProxiedSourceIp`, leaving one client for the whole
- * simulation. A rate limiting test sends its requests from one client and
- * expects the rule to trip, so that is the case anybody would write.
+ * `IP` counts each client address on its own. A request comes from
+ * `127.0.0.1` unless it states another address with `x-sim-aws-source-ip`, so
+ * a test that states none has one client for the whole simulation. That is
+ * the case a rate limiting test is usually written about: one client, sending
+ * until the rule trips.
  *
  * `CONSTANT` counts every request the statement sees together, and AWS asks
  * for a scope-down statement alongside it to say which requests those are. A
@@ -79,7 +79,7 @@ export function simWafRateAggregation(statement, ruleName) {
     const keyType = statement.AggregateKeyType;
     refuseUnsimulatedSimWafRateKeyType(keyType, ruleName);
     if (keyType === "IP") {
-        return () => simAwsProxiedSourceIp;
+        return (request) => request.sourceIp;
     }
     if (keyType === "CONSTANT") {
         if (statement.ScopeDownStatement === undefined) {

package/dist/service/wafv2/web-acl/sim-waf-action-input.js

@@ -18,6 +18,7 @@ export function simWafBlockedResponse(customResponse, bodies) {
         contentType: body?.contentType ?? fallback.contentType,
         body: body?.content ?? fallback.body,
         headers: simWafResponseHeaders(customResponse.ResponseHeaders),
+        isCustom: true,
     };
 }
 /**

package/docs/services/cloudfront/README.md

@@ -260,6 +260,11 @@ Origin again. A rule carrying it alone, with no `ResponsePagePath`, configures e
 status the Distribution serves no page for. See
 [What a Distribution stores](#what-a-distribution-stores).
 
+A request the Distribution's [web ACL](#web-acls) blocks gets the custom error response for 403
+as well. CloudFront cannot tell WAF's 403 from the Origin's, so a site mapping 403 to its not-found
+page serves that page to a blocked request too. A block action with a `CustomResponse` of its own
+is the exception (see [Web ACLs](#web-acls)).
+
 ## Serve simulated CloudFront on localhost
 
 Use `serveSimAws` to send HTTP requests through the simulated distribution on localhost.
@@ -1846,7 +1851,7 @@ the site serves from the Origin (see [Limitations](#limitations)).
 
 A Distribution can put a WAFv2 web ACL in front of everything it serves. Name the web ACL's ARN in
 `WebACLId` and the Distribution evaluates it against every request that arrives. A request the web
-ACL blocks gets 403 from the edge. A request it allows carries on to the cache Behavior and the
+ACL blocks is answered at the edge. A request it allows carries on to the cache Behavior and the
 Origin.
 
 CloudFront takes its web ACL this way. WAFv2's `AssociateWebACL` covers the regional resource types.
@@ -1859,6 +1864,17 @@ simulation never created, is refused with `InvalidWebACLId` at `CreateDistributi
 The web ACL decides before any other stage sees the request. A blocked request never reaches a
 viewer-request CloudFront Function, a cache Behavior, a response headers policy or the Origin.
 
+What a blocked request gets depends on the block action. A `CustomResponse` on the action is sent
+as the rule describes it, whatever its status, and the Distribution's `CustomErrorResponses` have no
+say. With no `CustomResponse`, WAF answers 403 and the Distribution treats it as it treats a 403
+from the Origin. A custom error response for 403 with a `ResponsePagePath` replaces it with the
+response page and its `ResponseCode`. Without one, the viewer gets WAF's 403. The order is the one
+[AWS documents for blocked requests](https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-for-blocked-requests.html).
+
+A blocked request's answer is never stored in the Distribution's cache, so `ErrorCachingMinTTL`
+has no effect on it. The next viewer to ask for the same URL is answered by WAF's decision about
+their own request.
+
 A CloudFormation Distribution naming a web ACL this simulation does not hold deploys without one.
 The `WebACLId` lands on `stack.ignoredProperties` and every request is served, including the ones
 the web ACL would have decided. A template naming a web ACL from a real account is ordinary, and a

package/docs/services/iam/README.md

@@ -771,6 +771,12 @@ was created, exactly as `runAs` behaves. The header is stripped before the reque
 simulated service. A Lambda handler echoing `event.headers` sees none of the simulator's control
 metadata.
 
+`x-sim-aws-source-ip` is a control header of the same kind. It names the client address a request
+comes from (one IPv4 or IPv6 address), and a request naming none comes from `127.0.0.1`. A web ACL
+reads it (see
+[where a request comes from](https://yulinsim.dev/services/wafv2/#where-a-request-comes-from)). IAM
+policy evaluation does not read it.
+
 ```typescript sim-iam-served-request-caller
 /**
  * Naming the caller of an HTTP request into simulated AWS.