@actsecurity/iam-data 0.21.202608301

package/data/conditionKeys/sagemaker.json

@@ -0,0 +1,342 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a key that is present in the request the user makes to the SageMaker service",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the list of all the tag key names associated with the resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:acceleratortypes": {
+    "key": "sagemaker:AcceleratorTypes",
+    "description": "Filters access by the list of all accelerator types associated with the resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:appnetworkaccesstype": {
+    "key": "sagemaker:AppNetworkAccessType",
+    "description": "Filters access by the app network access type associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:authmode": {
+    "key": "sagemaker:AuthMode",
+    "description": "Filters access by the authentication mode specified in the request",
+    "type": "String"
+  },
+  "sagemaker:bearertokentype": {
+    "key": "sagemaker:BearerTokenType",
+    "description": "Filters access by the type of bearer token used in the request",
+    "type": "String"
+  },
+  "sagemaker:currentcustomermetadataproperties/${metadatakey}": {
+    "key": "sagemaker:CurrentCustomerMetadataProperties/${MetadataKey}",
+    "description": "Filters access by a current metadata key and value pair associated with the model-package resource",
+    "type": "String"
+  },
+  "sagemaker:currentmodellifecyclestage": {
+    "key": "sagemaker:CurrentModelLifeCycleStage",
+    "description": "Filters access by the current value of the Stage field in the model life cycle object associated with the model-package resource",
+    "type": "String"
+  },
+  "sagemaker:currentmodellifecyclestagestatus": {
+    "key": "sagemaker:CurrentModelLifeCycleStageStatus",
+    "description": "Filters access by the current value of the StageStatus field in the model life cycle object associated with the model-package resource",
+    "type": "String"
+  },
+  "sagemaker:customermetadataproperties/${metadatakey}": {
+    "key": "sagemaker:CustomerMetadataProperties/${MetadataKey}",
+    "description": "Filters access by a metadata key and value pair",
+    "type": "String"
+  },
+  "sagemaker:customermetadatapropertiestoremove": {
+    "key": "sagemaker:CustomerMetadataPropertiesToRemove",
+    "description": "Filters access by the list of metadata properties associated with the model-package resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:directgatedmodelaccess": {
+    "key": "sagemaker:DirectGatedModelAccess",
+    "description": "Used to deny direct access to SageMaker gated ModelReferences",
+    "type": "String"
+  },
+  "sagemaker:directinternetaccess": {
+    "key": "sagemaker:DirectInternetAccess",
+    "description": "Filters access by the direct internet access associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:domainid": {
+    "key": "sagemaker:DomainId",
+    "description": "You can use the domainId as a policy variable to filter requests from specific SageMaker Domains",
+    "type": "String"
+  },
+  "sagemaker:domainsharingoutputkmskey": {
+    "key": "sagemaker:DomainSharingOutputKmsKey",
+    "description": "Filters access by the Domain sharing output KMS key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:DomainSharingOutputKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:domainsharingoutputkmskeyarn": {
+    "key": "sagemaker:DomainSharingOutputKmsKeyArn",
+    "description": "Filters access by the Domain sharing output KMS key associated with the resource in the request. The ARN of the key-id must be used",
+    "type": "ARN"
+  },
+  "sagemaker:enableremotedebug": {
+    "key": "sagemaker:EnableRemoteDebug",
+    "description": "Filters access by the remote debug config in the request",
+    "type": "Bool"
+  },
+  "sagemaker:featuregroupdisablegluetablecreation": {
+    "key": "sagemaker:FeatureGroupDisableGlueTableCreation",
+    "description": "Filters access by the DisableGlueTableCreation flag associated with the feature group resource in the request",
+    "type": "Bool"
+  },
+  "sagemaker:featuregroupenableonlinestore": {
+    "key": "sagemaker:FeatureGroupEnableOnlineStore",
+    "description": "Filters access by the EnableOnlineStore flag associated with feature group in the request",
+    "type": "Bool"
+  },
+  "sagemaker:featuregroupofflinestoreconfig": {
+    "key": "sagemaker:FeatureGroupOfflineStoreConfig",
+    "description": "Filters access by the presence of an OfflineStoreConfig in the feature group resource in the request. This access filter only supports the null-conditional operator",
+    "type": "Bool"
+  },
+  "sagemaker:featuregroupofflinestorekmskey": {
+    "key": "sagemaker:FeatureGroupOfflineStoreKmsKey",
+    "description": "Filters access by the offline store kms key associated with the feature group resource in the request. This key has been deprecated. It has been replaced by sagemaker:FeatureGroupOfflineStoreKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:featuregroupofflinestorekmskeyarn": {
+    "key": "sagemaker:FeatureGroupOfflineStoreKmsKeyArn",
+    "description": "Filters access by the offline store kms key associated with the feature group resource in the request. The ARN of the key-id must be used",
+    "type": "ARN"
+  },
+  "sagemaker:featuregroupofflinestores3uri": {
+    "key": "sagemaker:FeatureGroupOfflineStoreS3Uri",
+    "description": "Filters access by the offline store s3 uri associated with the feature group resource in the request",
+    "type": "String"
+  },
+  "sagemaker:featuregrouponlinestorekmskey": {
+    "key": "sagemaker:FeatureGroupOnlineStoreKmsKey",
+    "description": "Filters access by the online store kms key associated with the feature group resource in the request. This key has been deprecated. It has been replaced by sagemaker:FeatureGroupOnlineStoreKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:featuregrouponlinestorekmskeyarn": {
+    "key": "sagemaker:FeatureGroupOnlineStoreKmsKeyArn",
+    "description": "Filters access by the online store kms key associated with the feature group resource in the request. The ARN of the key-id must be used",
+    "type": "ARN"
+  },
+  "sagemaker:filesystemaccessmode": {
+    "key": "sagemaker:FileSystemAccessMode",
+    "description": "Filters access by a file system access mode associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:filesystemdirectorypath": {
+    "key": "sagemaker:FileSystemDirectoryPath",
+    "description": "Filters access by a file system directory path associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:filesystemid": {
+    "key": "sagemaker:FileSystemId",
+    "description": "Filters access by a file system ID associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:filesystemtype": {
+    "key": "sagemaker:FileSystemType",
+    "description": "Filters access by a file system type associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:homeefsfilesystemkmskey": {
+    "key": "sagemaker:HomeEfsFileSystemKmsKey",
+    "description": "Filters access by a key that is present in the request the user makes to the SageMaker service. This key has been deprecated. It has been replaced by sagemaker:VolumeKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:imagearns": {
+    "key": "sagemaker:ImageArns",
+    "description": "Filters access by the list of all image arns associated with the resource in the request",
+    "type": "ArrayOfARN"
+  },
+  "sagemaker:imageversionarns": {
+    "key": "sagemaker:ImageVersionArns",
+    "description": "Filters access by the list of all image version arns associated with the resource in the request",
+    "type": "ArrayOfARN"
+  },
+  "sagemaker:instancetypes": {
+    "key": "sagemaker:InstanceTypes",
+    "description": "Filters access by the list of all instance types associated with the resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:intercontainertrafficencryption": {
+    "key": "sagemaker:InterContainerTrafficEncryption",
+    "description": "Filters access by the inter container traffic encryption associated with the resource in the request",
+    "type": "Bool"
+  },
+  "sagemaker:isupdaterecord": {
+    "key": "sagemaker:IsUpdateRecord",
+    "description": "Filters access by whether the PutRecord authorization was triggered by an UpdateRecord API call. Set to true on UpdateRecord and false on direct PutRecord calls",
+    "type": "Bool"
+  },
+  "sagemaker:keepaliveperiod": {
+    "key": "sagemaker:KeepAlivePeriod",
+    "description": "Filters access by the keep-alive period associated with the resource in the request",
+    "type": "Numeric"
+  },
+  "sagemaker:maxruntimeinseconds": {
+    "key": "sagemaker:MaxRuntimeInSeconds",
+    "description": "Filters access by the max runtime in seconds associated with the resource in the request",
+    "type": "Numeric"
+  },
+  "sagemaker:minimuminstancemetadataserviceversion": {
+    "key": "sagemaker:MinimumInstanceMetadataServiceVersion",
+    "description": "Filters access by the minimum instance metadata service version used by the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:modelapprovalstatus": {
+    "key": "sagemaker:ModelApprovalStatus",
+    "description": "Filters access by the model approval status with the model-package in the request",
+    "type": "String"
+  },
+  "sagemaker:modelarn": {
+    "key": "sagemaker:ModelArn",
+    "description": "Filters access by the model arn associated with the resource in the request",
+    "type": "ARN"
+  },
+  "sagemaker:modellifecycle:stage": {
+    "key": "sagemaker:ModelLifeCycle:Stage",
+    "description": "Filters access by stage field in the model life cycle object associated with the model-package resource in the request",
+    "type": "String"
+  },
+  "sagemaker:modellifecycle:stagestatus": {
+    "key": "sagemaker:ModelLifeCycle:StageStatus",
+    "description": "Filters access by stageStatus field in the model life cycle object associated with the model-package resource in the request",
+    "type": "String"
+  },
+  "sagemaker:networkisolation": {
+    "key": "sagemaker:NetworkIsolation",
+    "description": "Filters access by the network isolation associated with the resource in the request",
+    "type": "Bool"
+  },
+  "sagemaker:notebookinstancelifecycleconfigarns": {
+    "key": "sagemaker:NotebookInstanceLifecycleConfigArns",
+    "description": "Filters access by the list of notebook instance lifecycle configuration ARNs associated with the resource in the request",
+    "type": "ArrayOfARN"
+  },
+  "sagemaker:outputkmskey": {
+    "key": "sagemaker:OutputKmsKey",
+    "description": "Filters access by the output kms key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:OutputKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:outputkmskeyarn": {
+    "key": "sagemaker:OutputKmsKeyArn",
+    "description": "Filters access by the output kms key associated with the resource in the request. The ARN of the key-id must be used",
+    "type": "ARN"
+  },
+  "sagemaker:owneruserprofilearn": {
+    "key": "sagemaker:OwnerUserProfileArn",
+    "description": "Filters access by the OwnerUserProfile arn associated with the space in the request",
+    "type": "ARN"
+  },
+  "sagemaker:pipelineversionid": {
+    "key": "sagemaker:PipelineVersionId",
+    "description": "Filters access to specific version IDs of a Sagemaker pipeline",
+    "type": "String"
+  },
+  "sagemaker:remoteaccess": {
+    "key": "sagemaker:RemoteAccess",
+    "description": "Filters access by the remote access flag associated with the space in the request",
+    "type": "String"
+  },
+  "sagemaker:resourcetag/": {
+    "key": "sagemaker:ResourceTag/",
+    "description": "Filters access by the preface string for a tag key and value pair attached to a resource",
+    "type": "String"
+  },
+  "sagemaker:resourcetag/${tagkey}": {
+    "key": "sagemaker:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "sagemaker:rootaccess": {
+    "key": "sagemaker:RootAccess",
+    "description": "Filters access by the root access associated with the resource in the request",
+    "type": "String"
+  },
+  "sagemaker:searchvisibilitycondition/${filterkey}": {
+    "key": "sagemaker:SearchVisibilityCondition/${FilterKey}",
+    "description": "Limits the results of your search request to the resources that you can access. ${FilterKey} is a key that the VisibilityConditions configuration presents in the Search request",
+    "type": "String"
+  },
+  "sagemaker:serverlessmaxconcurrency": {
+    "key": "sagemaker:ServerlessMaxConcurrency",
+    "description": "Filters access by limiting maximum concurrency used for Serverless inference in the request",
+    "type": "Numeric"
+  },
+  "sagemaker:serverlessmemorysize": {
+    "key": "sagemaker:ServerlessMemorySize",
+    "description": "Filters access by limiting memory size used for Serverless inference in the request",
+    "type": "Numeric"
+  },
+  "sagemaker:spacesharingtype": {
+    "key": "sagemaker:SpaceSharingType",
+    "description": "Filters access by the sharing type associated with the space in the request",
+    "type": "String"
+  },
+  "sagemaker:studiolifecycleconfigarns": {
+    "key": "sagemaker:StudioLifecycleConfigArns",
+    "description": "Filters access by the list of lifecycle configuration ARNs associated with the resource in the request",
+    "type": "ArrayOfARN"
+  },
+  "sagemaker:taggingaction": {
+    "key": "sagemaker:TaggingAction",
+    "description": "Filters access by the API actions to which a user can apply tags. Uses the name of the API operation that creates a taggable resource to filter access",
+    "type": "String"
+  },
+  "sagemaker:targetmodel": {
+    "key": "sagemaker:TargetModel",
+    "description": "Filters access by the target model associated with the Multi-Model Endpoint in the request",
+    "type": "String"
+  },
+  "sagemaker:updatablefeatures": {
+    "key": "sagemaker:UpdatableFeatures",
+    "description": "Filters access by the list of feature names being updated by an UpdateRecord API call. Absent on direct PutRecord calls",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:userprofilename": {
+    "key": "sagemaker:UserProfileName",
+    "description": "You can use the UserProfileName as a policy variable to filter requests from specific user profiles within a SageMaker Domain. This context key is not applicable to user profiles within shared spaces",
+    "type": "String"
+  },
+  "sagemaker:volumekmskey": {
+    "key": "sagemaker:VolumeKmsKey",
+    "description": "Filters access by the volume kms key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:VolumeKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:volumekmskeyarn": {
+    "key": "sagemaker:VolumeKmsKeyArn",
+    "description": "Filters access by the volume kms key associated with the resource in the request. The ARN of the key-id must be used",
+    "type": "ARN"
+  },
+  "sagemaker:vpcsecuritygroupids": {
+    "key": "sagemaker:VpcSecurityGroupIds",
+    "description": "Filters access by the list of all VPC security group ids associated with the resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:vpcsubnets": {
+    "key": "sagemaker:VpcSubnets",
+    "description": "Filters access by the list of all VPC subnets associated with the resource in the request",
+    "type": "ArrayOfString"
+  },
+  "sagemaker:workteamarn": {
+    "key": "sagemaker:WorkteamArn",
+    "description": "Filters access by the workteam arn associated to the request",
+    "type": "ARN"
+  },
+  "sagemaker:workteamtype": {
+    "key": "sagemaker:WorkteamType",
+    "description": "Filters access by the workteam type associated to the request. This can be public-crowd, private-crowd or vendor-crowd",
+    "type": "String"
+  }
+}

package/data/conditionKeys/savingsplans.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/scheduler.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the presence of tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by tag keys in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/schemas.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/scn.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by using tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by using tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by using tag keys in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/sdb.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/secretsmanager.json

@@ -0,0 +1,122 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a key that is present in the request the user makes to the Secrets Manager service",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the list of all the tag key names present in the request the user makes to the Secrets Manager service",
+    "type": "ArrayOfString"
+  },
+  "secretsmanager:addreplicaregions": {
+    "key": "secretsmanager:AddReplicaRegions",
+    "description": "Filters access by the list of Regions in which to replicate the secret",
+    "type": "ArrayOfString"
+  },
+  "secretsmanager:blockpublicpolicy": {
+    "key": "secretsmanager:BlockPublicPolicy",
+    "description": "Filters access by whether the resource policy blocks broad AWS account access",
+    "type": "Bool"
+  },
+  "secretsmanager:description": {
+    "key": "secretsmanager:Description",
+    "description": "Filters access by the description text in the request",
+    "type": "String"
+  },
+  "secretsmanager:externalsecretrotationrolearn": {
+    "key": "secretsmanager:ExternalSecretRotationRoleArn",
+    "description": "Filters access by the managed external secret rotation role ARN in the request",
+    "type": "ARN"
+  },
+  "secretsmanager:forcedeletewithoutrecovery": {
+    "key": "secretsmanager:ForceDeleteWithoutRecovery",
+    "description": "Filters access by whether the secret is to be deleted immediately without any recovery window",
+    "type": "Bool"
+  },
+  "secretsmanager:forceoverwritereplicasecret": {
+    "key": "secretsmanager:ForceOverwriteReplicaSecret",
+    "description": "Filters access by whether to overwrite a secret with the same name in the destination Region",
+    "type": "Bool"
+  },
+  "secretsmanager:kmskeyarn": {
+    "key": "secretsmanager:KmsKeyArn",
+    "description": "Filters access by the key ARN of the KMS key in the request",
+    "type": "ARN"
+  },
+  "secretsmanager:kmskeyid": {
+    "key": "secretsmanager:KmsKeyId",
+    "description": "Filters access by the key identifier of the KMS key in the request. Deprecated: Use secretsmanager:KmsKeyArn",
+    "type": "String"
+  },
+  "secretsmanager:modifyrotationrules": {
+    "key": "secretsmanager:ModifyRotationRules",
+    "description": "Filters access by whether the rotation rules of the secret are to be modified",
+    "type": "Bool"
+  },
+  "secretsmanager:name": {
+    "key": "secretsmanager:Name",
+    "description": "Filters access by the friendly name of the secret in the request",
+    "type": "String"
+  },
+  "secretsmanager:recoverywindowindays": {
+    "key": "secretsmanager:RecoveryWindowInDays",
+    "description": "Filters access by the number of days that Secrets Manager waits before it can delete the secret",
+    "type": "Numeric"
+  },
+  "secretsmanager:resourcetag/tag-key": {
+    "key": "secretsmanager:ResourceTag/tag-key",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "secretsmanager:rotateimmediately": {
+    "key": "secretsmanager:RotateImmediately",
+    "description": "Filters access by whether the secret is to be rotated immediately",
+    "type": "Bool"
+  },
+  "secretsmanager:rotationlambdaarn": {
+    "key": "secretsmanager:RotationLambdaARN",
+    "description": "Filters access by the ARN of the rotation Lambda function in the request",
+    "type": "ARN"
+  },
+  "secretsmanager:secretid": {
+    "key": "secretsmanager:SecretId",
+    "description": "Filters access by the SecretID value in the request",
+    "type": "ARN"
+  },
+  "secretsmanager:secretprimaryregion": {
+    "key": "secretsmanager:SecretPrimaryRegion",
+    "description": "Filters access by primary region in which the secret is created if the secret is a multi-Region secret",
+    "type": "String"
+  },
+  "secretsmanager:type": {
+    "key": "secretsmanager:Type",
+    "description": "Filters access by the managed external secret type in the request",
+    "type": "String"
+  },
+  "secretsmanager:versionid": {
+    "key": "secretsmanager:VersionId",
+    "description": "Filters access by the unique identifier of the version of the secret in the request",
+    "type": "String"
+  },
+  "secretsmanager:versionstage": {
+    "key": "secretsmanager:VersionStage",
+    "description": "Filters access by the list of version stages in the request",
+    "type": "String"
+  },
+  "secretsmanager:resource/allowrotationlambdaarn": {
+    "key": "secretsmanager:resource/AllowRotationLambdaArn",
+    "description": "Filters access by the ARN of the rotation Lambda function associated with the secret",
+    "type": "ARN"
+  },
+  "secretsmanager:resource/type": {
+    "key": "secretsmanager:resource/Type",
+    "description": "Filters access by the managed external secret type associated with the secret",
+    "type": "String"
+  }
+}

package/data/conditionKeys/security-ir.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/securityagent.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/securityhub.json

@@ -0,0 +1,32 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by actions based on the presence of tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by actions based on tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by actions based on the presence of tag keys in the request",
+    "type": "ArrayOfString"
+  },
+  "securityhub:asffsyntaxpath/${asffsyntaxpath}": {
+    "key": "securityhub:ASFFSyntaxPath/${ASFFSyntaxPath}",
+    "description": "Filters access by the specified fields and values in the request",
+    "type": "String"
+  },
+  "securityhub:ocsfsyntaxpath/${ocsfsyntaxpath}": {
+    "key": "securityhub:OCSFSyntaxPath/${OCSFSyntaxPath}",
+    "description": "Filters access by the specified fields and values in the request",
+    "type": "String"
+  },
+  "securityhub:targetaccount": {
+    "key": "securityhub:TargetAccount",
+    "description": "Filters access by the AwsAccountId field that is specified in the request",
+    "type": "String"
+  }
+}

package/data/conditionKeys/securitylake.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair of a resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/serverlessrepo.json

@@ -0,0 +1,7 @@
+{
+  "serverlessrepo:applicationtype": {
+    "key": "serverlessrepo:applicationType",
+    "description": "Filters access by application type",
+    "type": "String"
+  }
+}