@actsecurity/iam-data 0.21.202609231 → 0.21.202609261

package/data/actions/sagemaker.json

@@ -636,6 +636,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "attachclusternodenetworkinterface": {
+    "name": "AttachClusterNodeNetworkInterface",
+    "description": "Grants permission to attach an elastic network interface to a SageMaker HyperPod cluster node",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "attachclusternodevolume": {
     "name": "AttachClusterNodeVolume",
     "description": "Grants permission to attach an Amazon EBS volume to a SageMaker HyperPod cluster node",
@@ -2750,9 +2765,7 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "deleteflowdefinition": {

package/data/actions/securityagent.json

@@ -850,6 +850,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "handleprovidercallback": {
+    "name": "HandleProviderCallback",
+    "description": "Grants permission to handle the provider OAuth registration callback that completes integration setup",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "handleproviderregistrationcallback": {
     "name": "HandleProviderRegistrationCallback",
     "description": "Grants permission to handle the provider OAuth registration callback that completes integration setup",
@@ -881,6 +889,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listactormessages": {
+    "name": "ListActorMessages",
+    "description": "Grants permission to list the MFA messages received for an actor at its server-generated address",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listagentspaces": {
     "name": "ListAgentSpaces",
     "description": "Grants permission to list agent spaces",
@@ -1615,6 +1638,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updateintegration": {
+    "name": "UpdateIntegration",
+    "description": "Grants permission to update an integration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Integration",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updatepentest": {
     "name": "UpdatePentest",
     "description": "Grants permission to update an existing penetration test with new configuration or settings",

package/data/actions/social-messaging.json

@@ -176,6 +176,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getwhatsappcallpermission": {
+    "name": "GetWhatsAppCallPermission",
+    "description": "Grants permission to retrieve voice calling permission for a WhatsApp phone number",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "phone-number-id",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getwhatsappflow": {
     "name": "GetWhatsAppFlow",
     "description": "Grants permission to retrieve the metadata and status of a WhatsApp Flow",
@@ -370,6 +385,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "sendwhatsappcallevent": {
+    "name": "SendWhatsAppCallEvent",
+    "description": "Grants permission to send a voice calling event through WhatsApp",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "phone-number-id",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "sendwhatsappmessage": {
     "name": "SendWhatsAppMessage",
     "description": "Grants permission to send a message through WhatsApp",
@@ -434,6 +464,21 @@
     ],
     "dependentActions": []
   },
+  "updatelinkedwhatsappbusinessaccountphonenumber": {
+    "name": "UpdateLinkedWhatsAppBusinessAccountPhoneNumber",
+    "description": "Grants permission to update the settings of a linked WhatsApp phone number",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "phone-number-id",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updatewhatsappflow": {
     "name": "UpdateWhatsAppFlow",
     "description": "Grants permission to update the metadata of a WhatsApp Flow",

package/data/actions/wisdom.json

@@ -19,12 +19,6 @@
     "description": "Grants permission to activate a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -172,12 +166,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -220,12 +208,6 @@
     "description": "Grants permission to create an attachment to a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -241,12 +223,6 @@
     "description": "Grants permission to create a version of a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -284,12 +260,6 @@
     "description": "Grants permission to deactivate a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -430,12 +400,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -457,12 +421,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -503,12 +461,6 @@
     "description": "Grants permission to delete a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -524,12 +476,6 @@
     "description": "Grants permission to delete an attachment from a message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -545,12 +491,6 @@
     "description": "Grants permission to delete quick response",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "QuickResponse",
         "required": true,
@@ -646,12 +586,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -673,12 +607,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -694,12 +622,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -740,12 +662,6 @@
     "description": "Grants permission to retrieve a message template",
     "accessLevel": "Read",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -778,12 +694,6 @@
     "description": "Grants permission to retrieve content",
     "accessLevel": "Read",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "QuickResponse",
         "required": true,
@@ -919,12 +829,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -973,12 +877,6 @@
     "description": "Grants permission to list message template versions for the specified message template",
     "accessLevel": "List",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -1152,12 +1050,6 @@
     "description": "Grants permission to render a message template",
     "accessLevel": "Read",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -1482,12 +1374,6 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
-      },
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -1513,12 +1399,6 @@
     "description": "Grants permission to update content of the message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -1534,12 +1414,6 @@
     "description": "Grants permission to update metadata of the message template",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "MessageTemplate",
         "required": true,
@@ -1555,12 +1429,6 @@
     "description": "Grants permission to update information or content of the quick response",
     "accessLevel": "Write",
     "resourceTypes": [
-      {
-        "name": "KnowledgeBase",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
       {
         "name": "QuickResponse",
         "required": true,

package/data/categories/security-identity-and-compliance.json

@@ -32,6 +32,7 @@
     "mpa",
     "network-firewall",
     "network-security-director",
+    "network-security-manager",
     "pca-connector-ad",
     "pca-connector-scep",
     "ram",

package/data/conditionKeys/aws-external-anthropic.json

@@ -14,6 +14,11 @@
     "description": "Filters access by the Claude Platform role used for the console session",
     "type": "String"
   },
+  "aws-external-anthropic:keyarn": {
+    "key": "aws-external-anthropic:KeyArn",
+    "description": "Filters access by the KMS key ARN associated with the external key",
+    "type": "ARN"
+  },
   "aws:requesttag/${tagkey}": {
     "key": "aws:RequestTag/${TagKey}",
     "description": "Filters access by the tags that are passed in the request",

package/data/conditionKeys/ec2.json

@@ -79,6 +79,11 @@
     "description": "Filters access by the ID of an Availability Zone in an AWS Region",
     "type": "String"
   },
+  "ec2:bootmodeoverride": {
+    "key": "ec2:BootModeOverride",
+    "description": "Filters access by the boot mode",
+    "type": "String"
+  },
   "ec2:capacityreservationfleet": {
     "key": "ec2:CapacityReservationFleet",
     "description": "Filters access by the ARN of the Capacity Reservation Fleet",

package/data/conditionKeys/events.json

@@ -14,6 +14,11 @@
     "description": "Filters access by the tags in the request to event bus and rule actions",
     "type": "ArrayOfString"
   },
+  "events:contentfilterpresent": {
+    "key": "events:ContentFilterPresent",
+    "description": "Filters access by whether a subscriber declares a payload-scope content filter to CreateSubscriber and UpdateSubscriber actions",
+    "type": "Bool"
+  },
   "events:eventbusarn": {
     "key": "events:EventBusArn",
     "description": "Filters access by the ARN of the event buses that can be associated with an endpoint to CreateEndpoint and UpdateEndpoint actions",
@@ -24,6 +29,36 @@
     "description": "Filters access by AWS services. If a rule is created by an AWS service on your behalf, the value is the principal name of the service that created the rule",
     "type": "String"
   },
+  "events:metadata/${metadatakey}": {
+    "key": "events:Metadata/${MetadataKey}",
+    "description": "Filters access by a metadata key-value pair on the published event to PutRawEvents actions, or by the exact-match values declared for that key in a subscriber's metadata filter to CreateSubscriber and UpdateSubscriber actions",
+    "type": "ArrayOfString"
+  },
+  "events:metadata/${metadatakey}/matcher": {
+    "key": "events:Metadata/${MetadataKey}/Matcher",
+    "description": "Filters access by the match type declared for a metadata key in a subscriber's filter to CreateSubscriber and UpdateSubscriber actions",
+    "type": "String"
+  },
+  "events:policyname": {
+    "key": "events:PolicyName",
+    "description": "Filters access by the name of the resource policy specified in the request to resource policy actions",
+    "type": "String"
+  },
+  "events:systemmetadata/awsdetailtype": {
+    "key": "events:SystemMetadata/AwsDetailType",
+    "description": "Filters access by the detail type recorded in the system metadata of an event forwarded onto an event bus to PutEvents and PutRawEvents actions",
+    "type": "String"
+  },
+  "events:systemmetadata/awssource": {
+    "key": "events:SystemMetadata/AwsSource",
+    "description": "Filters access by the source recorded in the system metadata of an event forwarded onto an event bus to PutEvents and PutRawEvents actions",
+    "type": "String"
+  },
+  "events:systemmetadata/contenttype": {
+    "key": "events:SystemMetadata/ContentType",
+    "description": "Filters access by the content type declared on an event for PutRawEvents and for forwarded events authorized as PutEvents",
+    "type": "String"
+  },
   "events:targetarn": {
     "key": "events:TargetArn",
     "description": "Filters access by the ARN of a target that can be put to a rule to PutTargets actions. TargetARN doesn't include DeadLetterConfigArn",
@@ -56,12 +91,12 @@
   },
   "events:eventbusinvocation": {
     "key": "events:eventBusInvocation",
-    "description": "Filters access by whether the event was generated via API or cross-account bus invocation to PutEvents actions",
+    "description": "Filters access to PutEvents and PutRawEvents by whether an event was forwarded from an event bus rather than published through a direct API call",
     "type": "String"
   },
   "events:source": {
     "key": "events:source",
-    "description": "Filters access by the AWS service or AWS partner event source that generated the event to PutEvents and PutRule actions. Matches the literal string of the source field of the event",
+    "description": "Filters access by the AWS service or AWS partner event source that generated the event to PutEvents and PutRule actions, or by the configured source of an event source to the CreateEventSource and UpdateEventSource actions. Matches the literal string of the source field of the event",
     "type": "ArrayOfString"
   }
 }

package/data/conditionKeys/network-security-manager.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionPatterns.json

@@ -159,6 +159,10 @@
     "elasticmapreduce:RequestTag/.+?": "elasticmapreduce:RequestTag/${TagKey}",
     "elasticmapreduce:ResourceTag/.+?": "elasticmapreduce:ResourceTag/${TagKey}"
   },
+  "events": {
+    "events:Metadata/.+?": "events:Metadata/${MetadataKey}",
+    "events:Metadata/.+?/Matcher": "events:Metadata/${MetadataKey}/Matcher"
+  },
   "rds": {
     "rds:cluster-pg-tag/.+?": "rds:cluster-pg-tag/${TagKey}",
     "rds:cluster-snapshot-tag/.+?": "rds:cluster-snapshot-tag/${TagKey}",

package/data/resourceTypes/ec2.json

@@ -321,6 +321,7 @@
       "aws:TagKeys",
       "ec2:Attribute",
       "ec2:Attribute/${AttributeName}",
+      "ec2:BootModeOverride",
       "ec2:ImageID",
       "ec2:ImageType",
       "ec2:IsLaunchTemplateResource",

package/data/resourceTypes/elasticache.json

@@ -19,6 +19,9 @@
     "key": "globalreplicationgroup",
     "arn": "arn:${Partition}:elasticache::${Account}:globalreplicationgroup:${GlobalReplicationGroupId}",
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys",
       "elasticache:AtRestEncryptionEnabled",
       "elasticache:AuthTokenEnabled",
       "elasticache:AutomaticFailoverEnabled",

package/data/resourceTypes/events.json

@@ -30,10 +30,24 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "event-busv2": {
+    "key": "event-busv2",
+    "arn": "arn:${Partition}:events:${Region}:${Account}:event-busv2/${EventBusName}/${OpaqueId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "event-source": {
     "key": "event-source",
     "arn": "arn:${Partition}:events:${Region}::event-source/${EventSourceName}"
   },
+  "event-sourcev2": {
+    "key": "event-sourcev2",
+    "arn": "arn:${Partition}:events:${Region}:${Account}:event-sourcev2/${SourceType}/${EventSourceName}/${OpaqueId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "key": {
     "key": "key",
     "arn": "arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}"
@@ -64,6 +78,13 @@
     "key": "stop-instance",
     "arn": "arn:${Partition}:events:${Region}:${Account}:target/stop-instance"
   },
+  "subscriber": {
+    "key": "subscriber",
+    "arn": "arn:${Partition}:events:${Region}:${Account}:subscriber/${SubscriberName}/${OpaqueId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "terminate-instance": {
     "key": "terminate-instance",
     "arn": "arn:${Partition}:events:${Region}:${Account}:target/terminate-instance"