@actsecurity/iam-data 0.21.202608301

package/data/conditionKeys/ec2messages.json

@@ -0,0 +1,12 @@
+{
+  "ec2:sourceinstancearn": {
+    "key": "ec2:SourceInstanceARN",
+    "description": "Filters access by the ARN of the instance from which the request originated",
+    "type": "ARN"
+  },
+  "ssm:sourceinstancearn": {
+    "key": "ssm:SourceInstanceARN",
+    "description": "Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made. This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile",
+    "type": "ARN"
+  }
+}

package/data/conditionKeys/ecr-public.json

@@ -0,0 +1,22 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters create requests based on the allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters actions based on tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters create requests based on the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  },
+  "ecr-public:resourcetag/${tagkey}": {
+    "key": "ecr-public:ResourceTag/${TagKey}",
+    "description": "Filters actions based on tag-value associated with the resource",
+    "type": "String"
+  }
+}

package/data/conditionKeys/ecr.json

@@ -0,0 +1,27 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  },
+  "ecr:accountsetting": {
+    "key": "ecr:AccountSetting",
+    "description": "Filters access by the ECR account setting name",
+    "type": "String"
+  },
+  "ecr:resourcetag/${tagkey}": {
+    "key": "ecr:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  }
+}

package/data/conditionKeys/ecs-mcp.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/ecs.json

@@ -0,0 +1,157 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
+  "ecs:createaction": {
+    "key": "ecs:CreateAction",
+    "description": "Filters access by the name of a resource-creating API action",
+    "type": "String"
+  },
+  "ecs:resourcetag/${tagkey}": {
+    "key": "ecs:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "ecs:account-setting": {
+    "key": "ecs:account-setting",
+    "description": "Filters access by the Amazon ECS account setting name",
+    "type": "String"
+  },
+  "ecs:auto-assign-public-ip": {
+    "key": "ecs:auto-assign-public-ip",
+    "description": "Filters access by the public IP assignment configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode",
+    "type": "Bool"
+  },
+  "ecs:capacity-provider": {
+    "key": "ecs:capacity-provider",
+    "description": "Filters access by the ARN of an Amazon ECS capacity provider",
+    "type": "ArrayOfARN"
+  },
+  "ecs:cluster": {
+    "key": "ecs:cluster",
+    "description": "Filters access by the ARN of an Amazon ECS cluster",
+    "type": "ARN"
+  },
+  "ecs:compute-compatibility": {
+    "key": "ecs:compute-compatibility",
+    "description": "Filters access by the required compatibilities field provided in the request",
+    "type": "ArrayOfString"
+  },
+  "ecs:container-instances": {
+    "key": "ecs:container-instances",
+    "description": "Filters access by the ARN of an Amazon ECS container instance",
+    "type": "ARN"
+  },
+  "ecs:container-name": {
+    "key": "ecs:container-name",
+    "description": "Filters access by the name of an Amazon ECS container which is defined in the ECS task definition",
+    "type": "String"
+  },
+  "ecs:daemon": {
+    "key": "ecs:daemon",
+    "description": "Filters access by the ARN of an Amazon ECS daemon",
+    "type": "ARN"
+  },
+  "ecs:daemon-task-definition": {
+    "key": "ecs:daemon-task-definition",
+    "description": "Filters access by the ARN of an Amazon ECS daemon task definition",
+    "type": "ARN"
+  },
+  "ecs:enable-ebs-volumes": {
+    "key": "ecs:enable-ebs-volumes",
+    "description": "Filters access by the Amazon ECS managed Amazon EBS volume capability of your ECS task or service",
+    "type": "String"
+  },
+  "ecs:enable-ecs-managed-tags": {
+    "key": "ecs:enable-ecs-managed-tags",
+    "description": "Filters access by the enableECSManagedTags configuration of your Amazon ECS task or Amazon ECS service",
+    "type": "Bool"
+  },
+  "ecs:enable-execute-command": {
+    "key": "ecs:enable-execute-command",
+    "description": "Filters access by the execute-command capability of your Amazon ECS task or Amazon ECS service",
+    "type": "String"
+  },
+  "ecs:enable-service-connect": {
+    "key": "ecs:enable-service-connect",
+    "description": "Filters access by the enable field value in the Service Connect configuration",
+    "type": "String"
+  },
+  "ecs:enable-vpc-lattice": {
+    "key": "ecs:enable-vpc-lattice",
+    "description": "Filters access by the VPC lattice capability of your Amazon ECS service",
+    "type": "String"
+  },
+  "ecs:fargate-ephemeral-storage-kms-key": {
+    "key": "ecs:fargate-ephemeral-storage-kms-key",
+    "description": "Filters access by the AWS KMS key id provided in the request",
+    "type": "String"
+  },
+  "ecs:gateway": {
+    "key": "ecs:gateway",
+    "description": "Filters access by the ARN of an Amazon ECS gateway",
+    "type": "ARN"
+  },
+  "ecs:instance-metadata-tags-propagation": {
+    "key": "ecs:instance-metadata-tags-propagation",
+    "description": "Filters access by the instance metadata tags propagation setting of your Amazon ECS capacity provider",
+    "type": "Bool"
+  },
+  "ecs:namespace": {
+    "key": "ecs:namespace",
+    "description": "Filters access by the ARN of AWS Cloud Map namespace which is defined in the Service Connect Configuration",
+    "type": "ARN"
+  },
+  "ecs:privileged": {
+    "key": "ecs:privileged",
+    "description": "Filters access by the privileged field provided in the request",
+    "type": "String"
+  },
+  "ecs:propagate-tags": {
+    "key": "ecs:propagate-tags",
+    "description": "Filters access by the tag propagation configuration of your Amazon ECS task or Amazon ECS service",
+    "type": "String"
+  },
+  "ecs:service": {
+    "key": "ecs:service",
+    "description": "Filters access by the ARN of an Amazon ECS service",
+    "type": "ARN"
+  },
+  "ecs:subnet": {
+    "key": "ecs:subnet",
+    "description": "Filters access by the subnet configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode",
+    "type": "ArrayOfString"
+  },
+  "ecs:task": {
+    "key": "ecs:task",
+    "description": "Filters access by the ARN of an Amazon ECS task",
+    "type": "ARN"
+  },
+  "ecs:task-cpu": {
+    "key": "ecs:task-cpu",
+    "description": "Filters access by the task cpu, as an integer with 1024 = 1 vCPU, provided in the request",
+    "type": "Numeric"
+  },
+  "ecs:task-definition": {
+    "key": "ecs:task-definition",
+    "description": "Filters access by the ARN of an Amazon ECS task definition",
+    "type": "ARN"
+  },
+  "ecs:task-memory": {
+    "key": "ecs:task-memory",
+    "description": "Filters access by the task memory, as an integer representing MiB, provided in the request",
+    "type": "Numeric"
+  }
+}

package/data/conditionKeys/eks-auth.json

@@ -0,0 +1,7 @@
+{
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  }
+}

package/data/conditionKeys/eks-mcp.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/eks.json

@@ -0,0 +1,162 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a key that is present in the request the user makes to the EKS service",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the list of all the tag key names present in the request the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:accessentrytype": {
+    "key": "eks:accessEntryType",
+    "description": "Filters access by the access entry type present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:accessscope": {
+    "key": "eks:accessScope",
+    "description": "Filters access by the accessScope present in the associate / disassociate access policy requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:authenticationmode": {
+    "key": "eks:authenticationMode",
+    "description": "Filters access by the authenticationMode present in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:blockstorageenabled": {
+    "key": "eks:blockStorageEnabled",
+    "description": "Filters access by the block storage enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:bootstrapclustercreatoradminpermissions": {
+    "key": "eks:bootstrapClusterCreatorAdminPermissions",
+    "description": "Filters access by the bootstrapClusterCreatorAdminPermissions present in the create cluster request",
+    "type": "Bool"
+  },
+  "eks:bootstrapselfmanagedaddons": {
+    "key": "eks:bootstrapSelfManagedAddons",
+    "description": "Filters access by the bootstrapSelfManagedAddons present in the create cluster request",
+    "type": "Bool"
+  },
+  "eks:clientid": {
+    "key": "eks:clientId",
+    "description": "Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:clustername": {
+    "key": "eks:clusterName",
+    "description": "Filters access by the clusterName present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:computeconfigenabled": {
+    "key": "eks:computeConfigEnabled",
+    "description": "Filters access by the compute config enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:controlplaneegressmode": {
+    "key": "eks:controlPlaneEgressMode",
+    "description": "Filters access by the control plane egress mode specified in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:controlplanescalingtier": {
+    "key": "eks:controlPlaneScalingTier",
+    "description": "Filters access by the control plane scaling tier in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:deletionprotection": {
+    "key": "eks:deletionProtection",
+    "description": "Filters access by the deletion protection setting in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:elasticloadbalancingenabled": {
+    "key": "eks:elasticLoadBalancingEnabled",
+    "description": "Filters access by the elastic load balancing enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:encryptionconfigproviderkeyarns": {
+    "key": "eks:encryptionConfigProviderKeyArns",
+    "description": "Filters access by the KMS key ARNs in the create cluster / Associate Encryption Config request",
+    "type": "ArrayOfARN"
+  },
+  "eks:endpointprivateaccess": {
+    "key": "eks:endpointPrivateAccess",
+    "description": "Filters access by the endpoint private access setting in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:endpointpublicaccess": {
+    "key": "eks:endpointPublicAccess",
+    "description": "Filters access by the endpoint public access setting in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:issuerurl": {
+    "key": "eks:issuerUrl",
+    "description": "Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:kubeapiserverconfig": {
+    "key": "eks:kubeApiServerConfig",
+    "description": "Filters access by whether the kube-api-server configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:kubecontrollermanagerconfig": {
+    "key": "eks:kubeControllerManagerConfig",
+    "description": "Filters access by whether the kube-controller-manager configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:kubeschedulerconfig": {
+    "key": "eks:kubeSchedulerConfig",
+    "description": "Filters access by whether the kube-scheduler configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:kubernetesgroups": {
+    "key": "eks:kubernetesGroups",
+    "description": "Filters access by the kubernetesGroups present in the access entry requests the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:kubernetesversion": {
+    "key": "eks:kubernetesVersion",
+    "description": "Filters access by the Kubernetes version in the create cluster/ update cluster version request",
+    "type": "String"
+  },
+  "eks:loggingtype/${type}": {
+    "key": "eks:loggingType/${type}",
+    "description": "Filters access by the cluster logging enabled and type parameter in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:namespaces": {
+    "key": "eks:namespaces",
+    "description": "Filters access by the namespaces present in the associate / disassociate access policy requests the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:policyarn": {
+    "key": "eks:policyArn",
+    "description": "Filters access by the policyArn present in the access entry requests the user makes to the EKS service",
+    "type": "ARN"
+  },
+  "eks:principalarn": {
+    "key": "eks:principalArn",
+    "description": "Filters access by the principalArn present in the access entry requests requests the user makes to the EKS service",
+    "type": "ARN"
+  },
+  "eks:supporttype": {
+    "key": "eks:supportType",
+    "description": "Filters access by the supportType present in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:username": {
+    "key": "eks:username",
+    "description": "Filters access by the Kubernetes username present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:zonalshiftenabled": {
+    "key": "eks:zonalShiftEnabled",
+    "description": "Filters access by the zonal shift enabled setting in the create / update cluster request",
+    "type": "Bool"
+  }
+}

package/data/conditionKeys/elasticache.json

@@ -0,0 +1,122 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters actions based on the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters actions based on the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters actions based on the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticache:atrestencryptionenabled": {
+    "key": "elasticache:AtRestEncryptionEnabled",
+    "description": "Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present",
+    "type": "Bool"
+  },
+  "elasticache:authtokenenabled": {
+    "key": "elasticache:AuthTokenEnabled",
+    "description": "Filters access by the presence of non empty AuthToken parameter in the request",
+    "type": "Bool"
+  },
+  "elasticache:automaticfailoverenabled": {
+    "key": "elasticache:AutomaticFailoverEnabled",
+    "description": "Filters access by the AutomaticFailoverEnabled parameter in the request",
+    "type": "Bool"
+  },
+  "elasticache:cachenodetype": {
+    "key": "elasticache:CacheNodeType",
+    "description": "Filters access by the cacheNodeType parameter present in the request. This key can be used to restrict which cache node types can be used on cluster creation or scaling operations",
+    "type": "String"
+  },
+  "elasticache:cacheparametergroupname": {
+    "key": "elasticache:CacheParameterGroupName",
+    "description": "Filters access by the CacheParameterGroupName parameter in the request",
+    "type": "String"
+  },
+  "elasticache:clustermodeenabled": {
+    "key": "elasticache:ClusterModeEnabled",
+    "description": "Filters access by the cluster mode parameter present in the request. Default value for single node group (shard) creations is false",
+    "type": "Bool"
+  },
+  "elasticache:datastorageunit": {
+    "key": "elasticache:DataStorageUnit",
+    "description": "Filters access by the CacheUsageLimits.DataStorage.Unit parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "String"
+  },
+  "elasticache:durability": {
+    "key": "elasticache:Durability",
+    "description": "Filters access by the Durability parameter in the request. Valid values are default, async, sync, or disabled",
+    "type": "String"
+  },
+  "elasticache:enginetype": {
+    "key": "elasticache:EngineType",
+    "description": "Filters access by the engine type present in creation requests. For replication group creations, default engine 'redis' is used as key if parameter is not present",
+    "type": "String"
+  },
+  "elasticache:engineversion": {
+    "key": "elasticache:EngineVersion",
+    "description": "Filters access by the engineVersion parameter present in creation or cluster modification requests",
+    "type": "String"
+  },
+  "elasticache:kmskeyid": {
+    "key": "elasticache:KmsKeyId",
+    "description": "Filters access by the Key ID of the KMS key",
+    "type": "String"
+  },
+  "elasticache:maximumdatastorage": {
+    "key": "elasticache:MaximumDataStorage",
+    "description": "Filters access by the CacheUsageLimits.DataStorage.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:maximumecpupersecond": {
+    "key": "elasticache:MaximumECPUPerSecond",
+    "description": "Filters access by the CacheUsageLimits.ECPUPerSecond.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:minimumdatastorage": {
+    "key": "elasticache:MinimumDataStorage",
+    "description": "Filters access by the CacheUsageLimits.DataStorage.Minimum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:minimumecpupersecond": {
+    "key": "elasticache:MinimumECPUPerSecond",
+    "description": "Filters access by the CacheUsageLimits.ECPUPerSecond.Minimum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:multiazenabled": {
+    "key": "elasticache:MultiAZEnabled",
+    "description": "Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in",
+    "type": "Bool"
+  },
+  "elasticache:numnodegroups": {
+    "key": "elasticache:NumNodeGroups",
+    "description": "Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request. This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations",
+    "type": "Numeric"
+  },
+  "elasticache:replicaspernodegroup": {
+    "key": "elasticache:ReplicasPerNodeGroup",
+    "description": "Filters access by the number of replicas per node group (shards) specified in creations or scaling requests",
+    "type": "Numeric"
+  },
+  "elasticache:snapshotretentionlimit": {
+    "key": "elasticache:SnapshotRetentionLimit",
+    "description": "Filters access by the SnapshotRetentionLimit parameter in the request",
+    "type": "Numeric"
+  },
+  "elasticache:transitencryptionenabled": {
+    "key": "elasticache:TransitEncryptionEnabled",
+    "description": "Filters access by the TransitEncryptionEnabled parameter present in the request. For replication group creations, default value 'false' is used as key if parameter is not present",
+    "type": "Bool"
+  },
+  "elasticache:userauthenticationmode": {
+    "key": "elasticache:UserAuthenticationMode",
+    "description": "Filters access by the UserAuthenticationMode parameter in the request",
+    "type": "String"
+  }
+}

package/data/conditionKeys/elasticbeanstalk.json

@@ -0,0 +1,52 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters actions based on the presence of tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters actions based on tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters actions based on the presence of tag keys in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticbeanstalk:fromapplication": {
+    "key": "elasticbeanstalk:FromApplication",
+    "description": "Filters access by an application as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:fromapplicationversion": {
+    "key": "elasticbeanstalk:FromApplicationVersion",
+    "description": "Filters access by an application version as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:fromconfigurationtemplate": {
+    "key": "elasticbeanstalk:FromConfigurationTemplate",
+    "description": "Filters access by a configuration template as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:fromenvironment": {
+    "key": "elasticbeanstalk:FromEnvironment",
+    "description": "Filters access by an environment as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:fromplatform": {
+    "key": "elasticbeanstalk:FromPlatform",
+    "description": "Filters access by a platform as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:fromsolutionstack": {
+    "key": "elasticbeanstalk:FromSolutionStack",
+    "description": "Filters access by a solution stack as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:inapplication": {
+    "key": "elasticbeanstalk:InApplication",
+    "description": "Filters access by the application that contains the resource that the action operates on",
+    "type": "ARN"
+  }
+}

package/data/conditionKeys/elasticfilesystem.json

@@ -0,0 +1,37 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair that is allowed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair of a resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by a list of tag keys that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticfilesystem:accesspointarn": {
+    "key": "elasticfilesystem:AccessPointArn",
+    "description": "Filters access by the ARN of the access point used to mount the file system",
+    "type": "ARN"
+  },
+  "elasticfilesystem:accessedviamounttarget": {
+    "key": "elasticfilesystem:AccessedViaMountTarget",
+    "description": "Filters access by whether the file system is accessed via mount targets",
+    "type": "Bool"
+  },
+  "elasticfilesystem:createaction": {
+    "key": "elasticfilesystem:CreateAction",
+    "description": "Filters access by the name of a resource-creating API action",
+    "type": "String"
+  },
+  "elasticfilesystem:encrypted": {
+    "key": "elasticfilesystem:Encrypted",
+    "description": "Filters access by whether users can create only encrypted or unencrypted file systems",
+    "type": "Bool"
+  }
+}