v1.20.17

1.20.17 (2026-08-29)

Added

• deploy independent Resources in reverse (#1138) (cde093e), closes #1135
• enforce IAM's policy document limits (#1140) (c9774ca), closes #1134
• make a deploy Role from a policy document (#1142) (c87a078), closes #1133
• read CloudFront Functions back (#1144) (d350bed), closes #1131
• simulate AWS::CloudFront::CachePolicy (#1143) (9aff829), closes #1130

Fixed

• apply a runAs caller to direct sim calls (#1125) (6a6d1e5), closes #1117
• authorize iam:PassRole on a passed Role (#1126) (54b25db), closes #1116
• authorize kms:Decrypt on a SecureString read (#1124) (1d726fa), closes #1120
• authorize logs:GetDeliverySource on a deploy (#1139) (379b071), closes #1136
• authorize three Resource types on create (#1123) (9cae231), closes #1115
• log the error an invocation ended in (#1122) (5ff45c0), closes #1119
• name an unnamed Resource after its stack (#1132) (eea9af5), closes #1114
• trim generated names the way CFN does (#1127) (c0ca794), closes #1113

Faster

• memoize compiled IAM wildcard patterns (#1121) (5f8eeb9), closes #1118