@actsecurity/iam-data 0.21.202608301

package/data/actions/bedrock-agentcore.json

@@ -0,0 +1,4341 @@
+{
+  "allowvendedlogdeliveryforresource": {
+    "name": "AllowVendedLogDeliveryForResource",
+    "description": "Grants permission to configure vended telemetry for a resource",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "payment-manager",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "authorizeaction": {
+    "name": "AuthorizeAction",
+    "description": "Grants permission to evaluate Cedar policies for authorization requests",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewayassociatewebacl": {
+    "name": "GatewayAssociateWebACL",
+    "description": "Grants permission to associate an AWS WAF Web ACL with an AgentCore Gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaydisassociatewebacl": {
+    "name": "GatewayDisassociateWebACL",
+    "description": "Grants permission to remove the AWS WAF Web ACL association from an AgentCore Gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaygetwebaclforresource": {
+    "name": "GatewayGetWebACLForResource",
+    "description": "Grants permission to retrieve the AWS WAF Web ACL ARN currently associated with an AgentCore Gateway",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaylistresourcesforwebacl": {
+    "name": "GatewayListResourcesForWebACL",
+    "description": "Grants permission to list AgentCore Gateways associated with an AWS WAF Web ACL",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokegateway": {
+    "name": "InvokeGateway",
+    "description": "Grants permission to invoke a gateway",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokewebsearch": {
+    "name": "InvokeWebSearch",
+    "description": "Grants permission to invoke a web search target",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "web-search",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "manageadminpolicy": {
+    "name": "ManageAdminPolicy",
+    "description": "Grants permission to create or modify wildcard policies that apply to gateway resources",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "manageresourcescopedpolicy": {
+    "name": "ManageResourceScopedPolicy",
+    "description": "Grants permission to create or modify policies that apply to specific gateway resources",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "partiallyauthorizeactions": {
+    "name": "PartiallyAuthorizeActions",
+    "description": "Grants permission to perform partial evaluation of Cedar policies to authorize a caller to list tools they are allowed to call",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "passcapacityprovider": {
+    "name": "PassCapacityProvider",
+    "description": "Grants permission to pass a capacity provider to a runtime resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putsystemlogevents": {
+    "name": "PutSystemLogEvents",
+    "description": "Grants permission to collect system logs from the runtime instances",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:runtimeSessionId"
+    ],
+    "dependentActions": []
+  },
+  "synchronizegatewaytargets": {
+    "name": "SynchronizeGatewayTargets",
+    "description": "Grants permission to enable search on gateways",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "adddatasetexamples": {
+    "name": "AddDatasetExamples",
+    "description": "Grants permission to add examples to a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "batchcreatememoryrecords": {
+    "name": "BatchCreateMemoryRecords",
+    "description": "Grants permission to create one or more memory records",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:namespace"
+    ],
+    "dependentActions": []
+  },
+  "batchdeletememoryrecords": {
+    "name": "BatchDeleteMemoryRecords",
+    "description": "Grants permission to delete one or more memory records",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "batchputgatewayratelimits": {
+    "name": "BatchPutGatewayRateLimits",
+    "description": "Grants permission to batch put rate limits on a gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "batchupdatememoryrecords": {
+    "name": "BatchUpdateMemoryRecords",
+    "description": "Grants permission to update one or more memory records",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:namespace"
+    ],
+    "dependentActions": []
+  },
+  "completeresourcetokenauth": {
+    "name": "CompleteResourceTokenAuth",
+    "description": "Grants permission to retrieve access token with OAuth2 for 3LO flow to access external resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:InboundJwtClaim/aud",
+      "bedrock-agentcore:InboundJwtClaim/client_id",
+      "bedrock-agentcore:InboundJwtClaim/iss",
+      "bedrock-agentcore:InboundJwtClaim/scope",
+      "bedrock-agentcore:InboundJwtClaim/sub",
+      "bedrock-agentcore:userid"
+    ],
+    "dependentActions": []
+  },
+  "connectbrowserautomationstream": {
+    "name": "ConnectBrowserAutomationStream",
+    "description": "Grants permission to connect to a browser automation stream",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "connectbrowserliveviewstream": {
+    "name": "ConnectBrowserLiveViewStream",
+    "description": "Grants permission to connect to a browser live view stream",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createabtest": {
+    "name": "CreateABTest",
+    "description": "Grants permission to create an A/B test",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createagentruntime": {
+    "name": "CreateAgentRuntime",
+    "description": "Grants permission to create a new agent runtime",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "bedrock-agentcore:RuntimeAuthorizerType",
+      "bedrock-agentcore:securityGroups",
+      "bedrock-agentcore:subnets"
+    ],
+    "dependentActions": []
+  },
+  "createagentruntimeendpoint": {
+    "name": "CreateAgentRuntimeEndpoint",
+    "description": "Grants permission to create a new agent runtime endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createapikeycredentialprovider": {
+    "name": "CreateApiKeyCredentialProvider",
+    "description": "Grants permission to create a new API Key Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createbrowser": {
+    "name": "CreateBrowser",
+    "description": "Grants permission to create a new custom browser",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "bedrock-agentcore:securityGroups",
+      "bedrock-agentcore:subnets"
+    ],
+    "dependentActions": []
+  },
+  "createbrowserprofile": {
+    "name": "CreateBrowserProfile",
+    "description": "Grants permission to create a new browser profile",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createcapacityprovider": {
+    "name": "CreateCapacityProvider",
+    "description": "Grants permission to create a new capacity provider",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createcodeinterpreter": {
+    "name": "CreateCodeInterpreter",
+    "description": "Grants permission to create a new custom code interpreter",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "bedrock-agentcore:securityGroups",
+      "bedrock-agentcore:subnets"
+    ],
+    "dependentActions": []
+  },
+  "createconfigurationbundle": {
+    "name": "CreateConfigurationBundle",
+    "description": "Grants permission to create a new configuration bundle",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createdataset": {
+    "name": "CreateDataset",
+    "description": "Grants permission to create a new dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createdatasetversion": {
+    "name": "CreateDatasetVersion",
+    "description": "Grants permission to create a new version of a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createevaluator": {
+    "name": "CreateEvaluator",
+    "description": "Grants permission to create a new evaluator",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createevent": {
+    "name": "CreateEvent",
+    "description": "Grants permission to create an Event",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId",
+      "bedrock-agentcore:sessionId"
+    ],
+    "dependentActions": []
+  },
+  "creategateway": {
+    "name": "CreateGateway",
+    "description": "Grants permission to create a new gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "creategatewayratelimit": {
+    "name": "CreateGatewayRateLimit",
+    "description": "Grants permission to create a rate limit on a gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "creategatewayrule": {
+    "name": "CreateGatewayRule",
+    "description": "Grants permission to create a new rule in an existing gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "creategatewaytarget": {
+    "name": "CreateGatewayTarget",
+    "description": "Grants permission to create a new target in an existing gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createharness": {
+    "name": "CreateHarness",
+    "description": "Grants permission to create a new harness",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createharnessendpoint": {
+    "name": "CreateHarnessEndpoint",
+    "description": "Grants permission to create a new harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "creatememory": {
+    "name": "CreateMemory",
+    "description": "Grants permission to create a Memory resource",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "bedrock-agentcore:KmsKeyArn"
+    ],
+    "dependentActions": []
+  },
+  "createoauth2credentialprovider": {
+    "name": "CreateOauth2CredentialProvider",
+    "description": "Grants permission to create a new Credential Provider to access external resources with OAuth2 protocol",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createonlineevaluationconfig": {
+    "name": "CreateOnlineEvaluationConfig",
+    "description": "Grants permission to create a new online evaluation configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createpaymentconnector": {
+    "name": "CreatePaymentConnector",
+    "description": "Grants permission to create a new payment connector under a payment manager",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createpaymentcredentialprovider": {
+    "name": "CreatePaymentCredentialProvider",
+    "description": "Grants permission to create a new Payment Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createpaymentinstrument": {
+    "name": "CreatePaymentInstrument",
+    "description": "Grants permission to create a new payment instrument",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createpaymentmanager": {
+    "name": "CreatePaymentManager",
+    "description": "Grants permission to create a new payment manager",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "bedrock-agentcore:DiscoveryUrl"
+    ],
+    "dependentActions": []
+  },
+  "createpaymentsession": {
+    "name": "CreatePaymentSession",
+    "description": "Grants permission to create a new payment session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createpolicy": {
+    "name": "CreatePolicy",
+    "description": "Grants permission to create a new policy within a policy engine",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createpolicyengine": {
+    "name": "CreatePolicyEngine",
+    "description": "Grants permission to create a new policy engine",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createregistry": {
+    "name": "CreateRegistry",
+    "description": "Grants permission to create a new registry",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createregistryrecord": {
+    "name": "CreateRegistryRecord",
+    "description": "Grants permission to create a new registry record",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createworkloadidentity": {
+    "name": "CreateWorkloadIdentity",
+    "description": "Grants permission to create a new Workload Identity",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "deleteabtest": {
+    "name": "DeleteABTest",
+    "description": "Grants permission to delete an A/B test",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ab-test",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteagentruntime": {
+    "name": "DeleteAgentRuntime",
+    "description": "Grants permission to delete an agent runtime",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteagentruntimeendpoint": {
+    "name": "DeleteAgentRuntimeEndpoint",
+    "description": "Grants permission to delete an agent runtime endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteapikeycredentialprovider": {
+    "name": "DeleteApiKeyCredentialProvider",
+    "description": "Grants permission to delete a registered API Key Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletebatchevaluation": {
+    "name": "DeleteBatchEvaluation",
+    "description": "Grants permission to delete a batch evaluation",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "batch-evaluate",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletebrowser": {
+    "name": "DeleteBrowser",
+    "description": "Grants permission to delete a custom browser",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletebrowserprofile": {
+    "name": "DeleteBrowserProfile",
+    "description": "Grants permission to delete a browser profile",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser-profile",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletecapacityprovider": {
+    "name": "DeleteCapacityProvider",
+    "description": "Grants permission to delete a capacity provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletecapacityprovidersession": {
+    "name": "DeleteCapacityProviderSession",
+    "description": "Grants permission to delete a capacity provider session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletecodeinterpreter": {
+    "name": "DeleteCodeInterpreter",
+    "description": "Grants permission to delete a custom code interpreter",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteconfigurationbundle": {
+    "name": "DeleteConfigurationBundle",
+    "description": "Grants permission to delete a configuration bundle",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "configuration-bundle",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletedataset": {
+    "name": "DeleteDataset",
+    "description": "Grants permission to delete a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletedatasetexamples": {
+    "name": "DeleteDatasetExamples",
+    "description": "Grants permission to delete examples from a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteevaluator": {
+    "name": "DeleteEvaluator",
+    "description": "Grants permission to delete an evaluator",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "evaluator",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteevent": {
+    "name": "DeleteEvent",
+    "description": "Grants permission to delete an Event",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId",
+      "bedrock-agentcore:sessionId"
+    ],
+    "dependentActions": []
+  },
+  "deletegateway": {
+    "name": "DeleteGateway",
+    "description": "Grants permission to delete an existing gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletegatewayratelimit": {
+    "name": "DeleteGatewayRateLimit",
+    "description": "Grants permission to delete a rate limit on a gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletegatewayrule": {
+    "name": "DeleteGatewayRule",
+    "description": "Grants permission to delete an existing gateway rule",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletegatewaytarget": {
+    "name": "DeleteGatewayTarget",
+    "description": "Grants permission to delete an existing gateway target",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteharness": {
+    "name": "DeleteHarness",
+    "description": "Grants permission to delete a harness",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteharnessendpoint": {
+    "name": "DeleteHarnessEndpoint",
+    "description": "Grants permission to delete a harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletememory": {
+    "name": "DeleteMemory",
+    "description": "Grants permission to delete a Memory resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletememoryrecord": {
+    "name": "DeleteMemoryRecord",
+    "description": "Grants permission to delete a Memory Record",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteoauth2credentialprovider": {
+    "name": "DeleteOauth2CredentialProvider",
+    "description": "Grants permission to delete a registered OAuth2 Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteonlineevaluationconfig": {
+    "name": "DeleteOnlineEvaluationConfig",
+    "description": "Grants permission to delete an online evaluation configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "online-evaluation-config",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepaymentconnector": {
+    "name": "DeletePaymentConnector",
+    "description": "Grants permission to delete a payment connector",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepaymentcredentialprovider": {
+    "name": "DeletePaymentCredentialProvider",
+    "description": "Grants permission to delete a registered Payment Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepaymentinstrument": {
+    "name": "DeletePaymentInstrument",
+    "description": "Grants permission to delete a payment instrument",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepaymentmanager": {
+    "name": "DeletePaymentManager",
+    "description": "Grants permission to delete a payment manager",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepaymentsession": {
+    "name": "DeletePaymentSession",
+    "description": "Grants permission to delete a payment session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepolicy": {
+    "name": "DeletePolicy",
+    "description": "Grants permission to delete a policy",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletepolicyengine": {
+    "name": "DeletePolicyEngine",
+    "description": "Grants permission to delete a policy engine",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleterecommendation": {
+    "name": "DeleteRecommendation",
+    "description": "Grants permission to delete a recommendation",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "recommendation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteregistry": {
+    "name": "DeleteRegistry",
+    "description": "Grants permission to delete an existing registry",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteregistryrecord": {
+    "name": "DeleteRegistryRecord",
+    "description": "Grants permission to delete an existing registry record",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry-record",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteresourcepolicy": {
+    "name": "DeleteResourcePolicy",
+    "description": "Grants permission to delete the resource-based policy for a Bedrock resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteworkloadidentity": {
+    "name": "DeleteWorkloadIdentity",
+    "description": "Grants permission to delete a registered Workload Identity",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "evaluate": {
+    "name": "Evaluate",
+    "description": "Grants permission to run an evaluation using an evaluator",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "evaluator",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getabtest": {
+    "name": "GetABTest",
+    "description": "Grants permission to get details of an A/B test",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ab-test",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getagentcard": {
+    "name": "GetAgentCard",
+    "description": "Grants permission to retrieve an agent card for A2A",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getagentruntime": {
+    "name": "GetAgentRuntime",
+    "description": "Grants permission to get details of an agent runtime",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getagentruntimeendpoint": {
+    "name": "GetAgentRuntimeEndpoint",
+    "description": "Grants permission to get details of an agent runtime endpoint",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getapikeycredentialprovider": {
+    "name": "GetApiKeyCredentialProvider",
+    "description": "Grants permission to fetch a registered API Key Credential Provider by its name",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getbatchevaluation": {
+    "name": "GetBatchEvaluation",
+    "description": "Grants permission to get details of a batch evaluation",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "batch-evaluate",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getbrowser": {
+    "name": "GetBrowser",
+    "description": "Grants permission to get details of a browser",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getbrowserprofile": {
+    "name": "GetBrowserProfile",
+    "description": "Grants permission to get details of a browser profile",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "browser-profile",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getbrowsersession": {
+    "name": "GetBrowserSession",
+    "description": "Grants permission to get details of a browser session",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "browser",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcapacityprovider": {
+    "name": "GetCapacityProvider",
+    "description": "Grants permission to get details of a capacity provider",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcodeinterpreter": {
+    "name": "GetCodeInterpreter",
+    "description": "Grants permission to get details of a code interpreter",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcodeinterpretersession": {
+    "name": "GetCodeInterpreterSession",
+    "description": "Grants permission to get details of a code interpreter session",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getconfigurationbundle": {
+    "name": "GetConfigurationBundle",
+    "description": "Grants permission to get details of a configuration bundle",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "configuration-bundle",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getconfigurationbundleversion": {
+    "name": "GetConfigurationBundleVersion",
+    "description": "Grants permission to get a specific version of a configuration bundle",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "configuration-bundle",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getdataset": {
+    "name": "GetDataset",
+    "description": "Grants permission to get details of a dataset",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getevaluator": {
+    "name": "GetEvaluator",
+    "description": "Grants permission to get details of an evaluator",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "evaluator",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getevent": {
+    "name": "GetEvent",
+    "description": "Grants permission to fetch an Event",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId",
+      "bedrock-agentcore:sessionId"
+    ],
+    "dependentActions": []
+  },
+  "getgateway": {
+    "name": "GetGateway",
+    "description": "Grants permission to retrieve an existing gateway",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getgatewayratelimit": {
+    "name": "GetGatewayRateLimit",
+    "description": "Grants permission to retrieve a rate limit on a gateway",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getgatewayrule": {
+    "name": "GetGatewayRule",
+    "description": "Grants permission to retrieve an existing gateway rule",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getgatewaytarget": {
+    "name": "GetGatewayTarget",
+    "description": "Grants permission to retrieve an existing gateway target",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getharness": {
+    "name": "GetHarness",
+    "description": "Grants permission to get details of a harness",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getharnessendpoint": {
+    "name": "GetHarnessEndpoint",
+    "description": "Grants permission to get details of a harness endpoint",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getmemory": {
+    "name": "GetMemory",
+    "description": "Grants permission to fetch details for a Memory resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getmemoryrecord": {
+    "name": "GetMemoryRecord",
+    "description": "Grants permission to fetch a Memory Record",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getoauth2credentialprovider": {
+    "name": "GetOauth2CredentialProvider",
+    "description": "Grants permission to fetch a registered OAuth2 Credential Provider by its name",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getonlineevaluationconfig": {
+    "name": "GetOnlineEvaluationConfig",
+    "description": "Grants permission to get details of an online evaluation configuration",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "online-evaluation-config",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentconnector": {
+    "name": "GetPaymentConnector",
+    "description": "Grants permission to retrieve details of a payment connector",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentcredentialprovider": {
+    "name": "GetPaymentCredentialProvider",
+    "description": "Grants permission to fetch a registered Payment Credential Provider by its name",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentinstrument": {
+    "name": "GetPaymentInstrument",
+    "description": "Grants permission to retrieve details of a payment instrument",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentinstrumentbalance": {
+    "name": "GetPaymentInstrumentBalance",
+    "description": "Grants permission to retrieve the balance of a payment instrument",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentmanager": {
+    "name": "GetPaymentManager",
+    "description": "Grants permission to retrieve details of a payment manager",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpaymentsession": {
+    "name": "GetPaymentSession",
+    "description": "Grants permission to retrieve details of a payment session",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicy": {
+    "name": "GetPolicy",
+    "description": "Grants permission to retrieve a policy",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicyengine": {
+    "name": "GetPolicyEngine",
+    "description": "Grants permission to retrieve a policy engine",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicyenginesummary": {
+    "name": "GetPolicyEngineSummary",
+    "description": "Grants permission to retrieve a summary of a policy engine",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicygeneration": {
+    "name": "GetPolicyGeneration",
+    "description": "Grants permission to retrieve status and results of a policy generation request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-generation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicygenerationsummary": {
+    "name": "GetPolicyGenerationSummary",
+    "description": "Grants permission to retrieve a summary of a policy generation request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-generation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicysummary": {
+    "name": "GetPolicySummary",
+    "description": "Grants permission to retrieve a summary of a policy",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getrecommendation": {
+    "name": "GetRecommendation",
+    "description": "Grants permission to get details of a recommendation",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "recommendation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getregistry": {
+    "name": "GetRegistry",
+    "description": "Grants permission to retrieve an existing registry",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getregistryrecord": {
+    "name": "GetRegistryRecord",
+    "description": "Grants permission to retrieve an existing registry record",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "registry-record",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourceapikey": {
+    "name": "GetResourceApiKey",
+    "description": "Grants permission to retrieve an API Key associated with an Api Key Credential Provider",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourceoauth2token": {
+    "name": "GetResourceOauth2Token",
+    "description": "Grants permission to retrieve access token with OAuth2 2LO or 3LO flow to access external resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourcepaymenttoken": {
+    "name": "GetResourcePaymentToken",
+    "description": "Grants permission to retrieve a payment authentication token associated with a Payment Credential Provider",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourcepolicy": {
+    "name": "GetResourcePolicy",
+    "description": "Grants permission to retrieve the resource-based policy for a Bedrock resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gettokenvault": {
+    "name": "GetTokenVault",
+    "description": "Grants permission to fetch the current configuration of the TokenVault, including encryption settings",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getworkloadaccesstoken": {
+    "name": "GetWorkloadAccessToken",
+    "description": "Grants permission to retrieve an Workload access token for agentic workloads not acting on behalf of a user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getworkloadaccesstokenforjwt": {
+    "name": "GetWorkloadAccessTokenForJWT",
+    "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with JWT token",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:InboundJwtClaim/aud",
+      "bedrock-agentcore:InboundJwtClaim/client_id",
+      "bedrock-agentcore:InboundJwtClaim/iss",
+      "bedrock-agentcore:InboundJwtClaim/scope",
+      "bedrock-agentcore:InboundJwtClaim/sub"
+    ],
+    "dependentActions": []
+  },
+  "getworkloadaccesstokenforuserid": {
+    "name": "GetWorkloadAccessTokenForUserId",
+    "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with User Id",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:userid"
+    ],
+    "dependentActions": []
+  },
+  "getworkloadidentity": {
+    "name": "GetWorkloadIdentity",
+    "description": "Grants permission to fetch details for a specific Workload identity, including its name and allowed OAuth2 return URLs",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntime": {
+    "name": "InvokeAgentRuntime",
+    "description": "Grants permission to invoke an agent runtime endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntimecommand": {
+    "name": "InvokeAgentRuntimeCommand",
+    "description": "Grants permission to invoke commands on an agent runtime endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntimecommandshell": {
+    "name": "InvokeAgentRuntimeCommandShell",
+    "description": "Grants permission to invoke a command shell on an agent runtime endpoint over a web socket stream",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntimeforuser": {
+    "name": "InvokeAgentRuntimeForUser",
+    "description": "Grants permission to invoke an agent runtime endpoint with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntimewithwebsocketstream": {
+    "name": "InvokeAgentRuntimeWithWebSocketStream",
+    "description": "Grants permission to invoke an agent runtime endpoint with WebSocket stream",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeagentruntimewithwebsocketstreamforuser": {
+    "name": "InvokeAgentRuntimeWithWebSocketStreamForUser",
+    "description": "Grants permission to invoke an agent runtime endpoint with WebSocket stream and with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokecodeinterpreter": {
+    "name": "InvokeCodeInterpreter",
+    "description": "Grants permission to invoke a code interpreter session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeharness": {
+    "name": "InvokeHarness",
+    "description": "Grants permission to invoke a harness",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "invokeregistrymcp": {
+    "name": "InvokeRegistryMcp",
+    "description": "Grants permission to invoke an MCP operation against an existing registry",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listabtests": {
+    "name": "ListABTests",
+    "description": "Grants permission to list A/B tests",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listactors": {
+    "name": "ListActors",
+    "description": "Grants permission to list Actors",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listagentruntimeendpoints": {
+    "name": "ListAgentRuntimeEndpoints",
+    "description": "Grants permission to list agent runtime endpoints",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listagentruntimeversions": {
+    "name": "ListAgentRuntimeVersions",
+    "description": "Grants permission to list agent runtime versions",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listagentruntimeversionsbycapacityprovider": {
+    "name": "ListAgentRuntimeVersionsByCapacityProvider",
+    "description": "Grants permission to list agent runtime versions by capacity provider",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listagentruntimes": {
+    "name": "ListAgentRuntimes",
+    "description": "Grants permission to list agent runtimes",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listapikeycredentialproviders": {
+    "name": "ListApiKeyCredentialProviders",
+    "description": "Grants permission to list all API Key Credential Providers in the Token Vault",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listbatchevaluations": {
+    "name": "ListBatchEvaluations",
+    "description": "Grants permission to list batch evaluations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listbrowserprofiles": {
+    "name": "ListBrowserProfiles",
+    "description": "Grants permission to list browser profiles",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listbrowsersessions": {
+    "name": "ListBrowserSessions",
+    "description": "Grants permission to list browser sessions",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listbrowsers": {
+    "name": "ListBrowsers",
+    "description": "Grants permission to list browsers",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcapacityproviders": {
+    "name": "ListCapacityProviders",
+    "description": "Grants permission to list capacity providers",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcodeinterpretersessions": {
+    "name": "ListCodeInterpreterSessions",
+    "description": "Grants permission to list code interpreter sessions",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcodeinterpreters": {
+    "name": "ListCodeInterpreters",
+    "description": "Grants permission to list code interpreters",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listconfigurationbundleversions": {
+    "name": "ListConfigurationBundleVersions",
+    "description": "Grants permission to list versions of a configuration bundle",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "configuration-bundle",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listconfigurationbundles": {
+    "name": "ListConfigurationBundles",
+    "description": "Grants permission to list configuration bundles",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdatasetexamples": {
+    "name": "ListDatasetExamples",
+    "description": "Grants permission to list examples in a dataset",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdatasetversions": {
+    "name": "ListDatasetVersions",
+    "description": "Grants permission to list versions of a dataset",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdatasets": {
+    "name": "ListDatasets",
+    "description": "Grants permission to list datasets",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listevaluators": {
+    "name": "ListEvaluators",
+    "description": "Grants permission to list evaluators",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listevents": {
+    "name": "ListEvents",
+    "description": "Grants permission to list events",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId",
+      "bedrock-agentcore:sessionId"
+    ],
+    "dependentActions": []
+  },
+  "listgatewayratelimits": {
+    "name": "ListGatewayRateLimits",
+    "description": "Grants permission to list rate limits on a gateway",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listgatewayrules": {
+    "name": "ListGatewayRules",
+    "description": "Grants permission to list existing gateway rules",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listgatewaytargets": {
+    "name": "ListGatewayTargets",
+    "description": "Grants permission to list existing gateway targets",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listgateways": {
+    "name": "ListGateways",
+    "description": "Grants permission to list existing gateways",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listharnessendpoints": {
+    "name": "ListHarnessEndpoints",
+    "description": "Grants permission to list harness endpoints",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listharnessversions": {
+    "name": "ListHarnessVersions",
+    "description": "Grants permission to list harness versions",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listharnesses": {
+    "name": "ListHarnesses",
+    "description": "Grants permission to list harnesses",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmemories": {
+    "name": "ListMemories",
+    "description": "Grants permission to list memory resources",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmemoryextractionjobs": {
+    "name": "ListMemoryExtractionJobs",
+    "description": "Grants permission to list extraction jobs for this memory",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmemoryrecords": {
+    "name": "ListMemoryRecords",
+    "description": "Grants permission to list memory records",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:namespace",
+      "bedrock-agentcore:strategyId"
+    ],
+    "dependentActions": []
+  },
+  "listoauth2credentialproviders": {
+    "name": "ListOauth2CredentialProviders",
+    "description": "Grants permission to list all OAuth2 Credential Providers in the Token Vault",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listonlineevaluationconfigs": {
+    "name": "ListOnlineEvaluationConfigs",
+    "description": "Grants permission to list online evaluation configurations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpaymentconnectors": {
+    "name": "ListPaymentConnectors",
+    "description": "Grants permission to list payment connectors under a payment manager",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpaymentcredentialproviders": {
+    "name": "ListPaymentCredentialProviders",
+    "description": "Grants permission to list all Payment Credential Providers in the Token Vault",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpaymentinstruments": {
+    "name": "ListPaymentInstruments",
+    "description": "Grants permission to list payment instruments",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpaymentmanagers": {
+    "name": "ListPaymentManagers",
+    "description": "Grants permission to list payment managers",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpaymentsessions": {
+    "name": "ListPaymentSessions",
+    "description": "Grants permission to list payment sessions",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicies": {
+    "name": "ListPolicies",
+    "description": "Grants permission to list policies within a policy engine",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicyenginesummaries": {
+    "name": "ListPolicyEngineSummaries",
+    "description": "Grants permission to list policy engine summaries",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicyengines": {
+    "name": "ListPolicyEngines",
+    "description": "Grants permission to list policy engines",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicygenerationassets": {
+    "name": "ListPolicyGenerationAssets",
+    "description": "Grants permission to list generated policy assets from a generation request",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-generation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicygenerationsummaries": {
+    "name": "ListPolicyGenerationSummaries",
+    "description": "Grants permission to list policy generation summaries",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicygenerations": {
+    "name": "ListPolicyGenerations",
+    "description": "Grants permission to list policy generation requests",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listpolicysummaries": {
+    "name": "ListPolicySummaries",
+    "description": "Grants permission to list policy summaries within a policy engine",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listrecommendations": {
+    "name": "ListRecommendations",
+    "description": "Grants permission to list recommendations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listregistries": {
+    "name": "ListRegistries",
+    "description": "Grants permission to list existing registries",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listregistryrecords": {
+    "name": "ListRegistryRecords",
+    "description": "Grants permission to list existing registry records in a registry",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listsessions": {
+    "name": "ListSessions",
+    "description": "Grants permission to list sessions",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId"
+    ],
+    "dependentActions": []
+  },
+  "listtagsforresource": {
+    "name": "ListTagsForResource",
+    "description": "Grants permission to list tags for a Bedrock-AgentCore resource",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-profile",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "capacity-provider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "evaluator",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "memory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "online-evaluation-config",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "payment-manager",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "paymentcredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listworkloadidentities": {
+    "name": "ListWorkloadIdentities",
+    "description": "Grants permission to list all Workload Identities in the caller's AWS account",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "processpayment": {
+    "name": "ProcessPayment",
+    "description": "Grants permission to process a payment transaction",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putresourcepolicy": {
+    "name": "PutResourcePolicy",
+    "description": "Grants permission to create or update the resource-based policy for a Bedrock resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "retrievememoryrecords": {
+    "name": "RetrieveMemoryRecords",
+    "description": "Grants permission to retrieve memory records through sematic query",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:namespace",
+      "bedrock-agentcore:strategyId"
+    ],
+    "dependentActions": []
+  },
+  "savebrowsersessionprofile": {
+    "name": "SaveBrowserSessionProfile",
+    "description": "Grants permission to save a browser session profile",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-profile",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "searchregistryrecords": {
+    "name": "SearchRegistryRecords",
+    "description": "Grants permission to search for registry records",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "settokenvaultcmk": {
+    "name": "SetTokenVaultCMK",
+    "description": "Grants permission to associate a Customer Managed Key (CMK) or a Service Managed Key with a specific TokenVault",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startbatchevaluation": {
+    "name": "StartBatchEvaluation",
+    "description": "Grants permission to start a batch evaluation",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startbrowsersession": {
+    "name": "StartBrowserSession",
+    "description": "Grants permission to start a new browser session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-profile",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startcodeinterpretersession": {
+    "name": "StartCodeInterpreterSession",
+    "description": "Grants permission to start a new code interpreter session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startmemoryextractionjob": {
+    "name": "StartMemoryExtractionJob",
+    "description": "Grants permission to start memory extraction job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:actorId",
+      "bedrock-agentcore:sessionId",
+      "bedrock-agentcore:strategyId"
+    ],
+    "dependentActions": []
+  },
+  "startpolicygeneration": {
+    "name": "StartPolicyGeneration",
+    "description": "Grants permission to start an AI-powered policy generation request",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startrecommendation": {
+    "name": "StartRecommendation",
+    "description": "Grants permission to start a recommendation",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopbatchevaluation": {
+    "name": "StopBatchEvaluation",
+    "description": "Grants permission to stop a batch evaluation",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "batch-evaluate",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopbrowsersession": {
+    "name": "StopBrowserSession",
+    "description": "Grants permission to stop a browser session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopcodeinterpretersession": {
+    "name": "StopCodeInterpreterSession",
+    "description": "Grants permission to stop a code interpreter session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "code-interpreter",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopruntimesession": {
+    "name": "StopRuntimeSession",
+    "description": "Grants permission to stop a runtime session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "submitregistryrecordforapproval": {
+    "name": "SubmitRegistryRecordForApproval",
+    "description": "Grants permission to submit a registry record for approval",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry-record",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "tagresource": {
+    "name": "TagResource",
+    "description": "Grants permission to Tag a Bedrock-AgentCore resource",
+    "accessLevel": "Tagging, Write",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-profile",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "capacity-provider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "evaluator",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "memory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "online-evaluation-config",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "payment-manager",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "paymentcredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "untagresource": {
+    "name": "UntagResource",
+    "description": "Grants permission to Untag a Bedrock-AgentCore resource",
+    "accessLevel": "Tagging, Write",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-profile",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "capacity-provider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "code-interpreter-custom",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "evaluator",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "gateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "memory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "online-evaluation-config",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "payment-manager",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "paymentcredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "updateabtest": {
+    "name": "UpdateABTest",
+    "description": "Grants permission to update an A/B test",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ab-test",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateagentruntime": {
+    "name": "UpdateAgentRuntime",
+    "description": "Grants permission to update an agent runtime",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:RuntimeAuthorizerType",
+      "bedrock-agentcore:securityGroups",
+      "bedrock-agentcore:subnets"
+    ],
+    "dependentActions": []
+  },
+  "updateagentruntimeendpoint": {
+    "name": "UpdateAgentRuntimeEndpoint",
+    "description": "Grants permission to update an agent runtime endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "runtime",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "runtime-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateapikeycredentialprovider": {
+    "name": "UpdateApiKeyCredentialProvider",
+    "description": "Grants permission to update an existing API Key Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatebrowserstream": {
+    "name": "UpdateBrowserStream",
+    "description": "Grants permission to update the status of browser session stream",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "browser",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "browser-custom",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatecapacityprovider": {
+    "name": "UpdateCapacityProvider",
+    "description": "Grants permission to update a capacity provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "capacity-provider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateconfigurationbundle": {
+    "name": "UpdateConfigurationBundle",
+    "description": "Grants permission to update a configuration bundle",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "configuration-bundle",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatedataset": {
+    "name": "UpdateDataset",
+    "description": "Grants permission to update a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatedatasetexamples": {
+    "name": "UpdateDatasetExamples",
+    "description": "Grants permission to update examples in a dataset",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateevaluator": {
+    "name": "UpdateEvaluator",
+    "description": "Grants permission to update an evaluator",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "evaluator",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updategateway": {
+    "name": "UpdateGateway",
+    "description": "Grants permission to update an existing gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updategatewayratelimit": {
+    "name": "UpdateGatewayRateLimit",
+    "description": "Grants permission to update a rate limit on a gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updategatewayrule": {
+    "name": "UpdateGatewayRule",
+    "description": "Grants permission to update an existing gateway rule",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updategatewaytarget": {
+    "name": "UpdateGatewayTarget",
+    "description": "Grants permission to update an existing gateway target",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateharness": {
+    "name": "UpdateHarness",
+    "description": "Grants permission to update a harness",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateharnessendpoint": {
+    "name": "UpdateHarnessEndpoint",
+    "description": "Grants permission to update harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatememory": {
+    "name": "UpdateMemory",
+    "description": "Grants permission to update a Memory resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "memory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateoauth2credentialprovider": {
+    "name": "UpdateOauth2CredentialProvider",
+    "description": "Grants permission to update an existing OAuth2 Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateonlineevaluationconfig": {
+    "name": "UpdateOnlineEvaluationConfig",
+    "description": "Grants permission to update an online evaluation configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "online-evaluation-config",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatepaymentconnector": {
+    "name": "UpdatePaymentConnector",
+    "description": "Grants permission to update an existing payment connector",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatepaymentcredentialprovider": {
+    "name": "UpdatePaymentCredentialProvider",
+    "description": "Grants permission to update an existing Payment Credential Provider",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "paymentcredentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatepaymentmanager": {
+    "name": "UpdatePaymentManager",
+    "description": "Grants permission to update an existing payment manager",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "payment-manager",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:DiscoveryUrl"
+    ],
+    "dependentActions": []
+  },
+  "updatepolicy": {
+    "name": "UpdatePolicy",
+    "description": "Grants permission to update an existing policy",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatepolicyengine": {
+    "name": "UpdatePolicyEngine",
+    "description": "Grants permission to update a policy engine",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateregistry": {
+    "name": "UpdateRegistry",
+    "description": "Grants permission to update an existing registry",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateregistryrecord": {
+    "name": "UpdateRegistryRecord",
+    "description": "Grants permission to update an existing registry record",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry-record",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateregistryrecordstatus": {
+    "name": "UpdateRegistryRecordStatus",
+    "description": "Grants permission to update the status of a registry record",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "registry-record",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateworkloadidentity": {
+    "name": "UpdateWorkloadIdentity",
+    "description": "Grants permission to update the metadata of an existing Workload Identity",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  }
+}