@actsecurity/iam-data 0.22.202611051 → 0.22.202611071

package/data/actions/route53domains.json

@@ -215,6 +215,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "restoredomain": {
+    "name": "RestoreDomain",
+    "description": "Grants permission to restore domains",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "retrievedomainauthcode": {
     "name": "RetrieveDomainAuthCode",
     "description": "Grants permission to get the AuthCode for the domain",

package/data/actions/ssm.json

@@ -629,6 +629,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deregisterdefaulthostmanagementconfiguration": {
+    "name": "DeregisterDefaultHostManagementConfiguration",
+    "description": "Grants permission to disable Default Host Management Configuration (DHMC) for an AWS account and Region",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deregistermanagedinstance": {
     "name": "DeregisterManagedInstance",
     "description": "Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager",
@@ -1942,6 +1950,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "registerdefaulthostmanagementconfiguration": {
+    "name": "RegisterDefaultHostManagementConfiguration",
+    "description": "Grants permission to enable Default Host Management Configuration (DHMC) for an AWS account and Region",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "registerdefaultpatchbaseline": {
     "name": "RegisterDefaultPatchBaseline",
     "description": "Grants permission to specify the default patch baseline for an operating system type",

package/data/actions/ssmmessages.json

@@ -30,7 +30,17 @@
     "name": "OpenDataChannel",
     "description": "Grants permission to open a websocket connection for a registered data channel stream from an instance to Systems Manager service",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "session",
+        "required": true,
+        "conditionKeys": [
+          "ssm:resourceTag/aws:ssmmessages:session-id",
+          "ssm:resourceTag/aws:ssmmessages:target-id"
+        ],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   }

package/data/conditionKeys/glue.json

@@ -14,11 +14,21 @@
     "description": "Filters access by the presence of tag keys in the request",
     "type": "ArrayOfString"
   },
+  "glue:connectiontype": {
+    "key": "glue:ConnectionType",
+    "description": "Filters access by the connection type specified in the request",
+    "type": "String"
+  },
   "glue:credentialissuingservice": {
     "key": "glue:CredentialIssuingService",
     "description": "Filters access by the service from which the credentials of the request is issued",
     "type": "String"
   },
+  "glue:credentialvendingmode": {
+    "key": "glue:CredentialVendingMode",
+    "description": "Filters access by the credential vending mode connection property specified in the request",
+    "type": "String"
+  },
   "glue:enabledforredshiftautodiscovery": {
     "key": "glue:EnabledForRedshiftAutoDiscovery",
     "description": "Filters access by the presence of the key configured for role's identity-based policy",
@@ -29,6 +39,11 @@
     "description": "Filters access by whether the resource belongs to federated authorization",
     "type": "String"
   },
+  "glue:instanceurl": {
+    "key": "glue:InstanceUrl",
+    "description": "Filters access by the URL and INSTANCE_URL connection property specified in the request",
+    "type": "String"
+  },
   "glue:lakeformationpermissions": {
     "key": "glue:LakeFormationPermissions",
     "description": "Filters access by whether Lake Formation permission checks will be performed for a given caller and the Glue resource",

package/data/conditionKeys/ram.json

@@ -21,17 +21,22 @@
   },
   "ram:permissionarn": {
     "key": "ram:PermissionArn",
-    "description": "Filters access by the specified Permission ARN",
+    "description": "Filters access by the specified Permission ARN. WARNING: We recommend using ram:RequestedPermissionArns instead",
     "type": "ARN"
   },
   "ram:permissionresourcetype": {
     "key": "ram:PermissionResourceType",
-    "description": "Filters access by permissions of specified resource type",
+    "description": "Filters access by permissions of specified resource type. WARNING: We recommend using ram:RequestedPermissionResourceTypes instead",
     "type": "String"
   },
+  "ram:permissiontemplateparameter/${parametername}": {
+    "key": "ram:PermissionTemplateParameter/${ParameterName}",
+    "description": "Filters access by permission template parameter values",
+    "type": "ArrayOfString"
+  },
   "ram:principal": {
     "key": "ram:Principal",
-    "description": "Filters access by format of the specified principal",
+    "description": "Filters access by format of the specified principal. WARNING: We recommend using ram:RequestedPrincipals instead",
     "type": "String"
   },
   "ram:requestedallowsexternalprincipals": {
@@ -39,14 +44,39 @@
     "description": "Filters access by the specified value for 'allowExternalPrincipals'. External principals are AWS accounts that are outside of its AWS Organization",
     "type": "Bool"
   },
+  "ram:requestedpermissionarns": {
+    "key": "ram:RequestedPermissionArns",
+    "description": "Filters access by the specified Permission ARNs",
+    "type": "ArrayOfARN"
+  },
+  "ram:requestedpermissionresourcetypes": {
+    "key": "ram:RequestedPermissionResourceTypes",
+    "description": "Filters access by permissions of specified resource types",
+    "type": "ArrayOfString"
+  },
+  "ram:requestedprincipals": {
+    "key": "ram:RequestedPrincipals",
+    "description": "Filters access by format of the specified principals",
+    "type": "ArrayOfString"
+  },
+  "ram:requestedresourcearns": {
+    "key": "ram:RequestedResourceArns",
+    "description": "Filters access by the specified ARNs",
+    "type": "ArrayOfARN"
+  },
   "ram:requestedresourcetype": {
     "key": "ram:RequestedResourceType",
-    "description": "Filters access by the specified resource type",
+    "description": "Filters access by the specified resource type. WARNING: We recommend using ram:RequestedResourceTypes instead",
     "type": "String"
   },
+  "ram:requestedresourcetypes": {
+    "key": "ram:RequestedResourceTypes",
+    "description": "Filters access by the specified resource types",
+    "type": "ArrayOfString"
+  },
   "ram:resourcearn": {
     "key": "ram:ResourceArn",
-    "description": "Filters access by  the specified ARN",
+    "description": "Filters access by the specified ARN. WARNING: We recommend using ram:RequestedResourceArns instead",
     "type": "ARN"
   },
   "ram:resourcesharename": {

package/data/conditionKeys/ssmmessages.json

@@ -8,5 +8,15 @@
     "key": "ssm:SourceInstanceARN",
     "description": "Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made. This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile",
     "type": "ARN"
+  },
+  "ssm:resourcetag/aws:ssmmessages:session-id": {
+    "key": "ssm:resourceTag/aws:ssmmessages:session-id",
+    "description": "Filters access by the user ID of the principal that started the session, as recorded in the AWS-supplied aws:ssmmessages:session-id tag",
+    "type": "String"
+  },
+  "ssm:resourcetag/aws:ssmmessages:target-id": {
+    "key": "ssm:resourceTag/aws:ssmmessages:target-id",
+    "description": "Filters access by the ID of the managed node that the session connects to, as recorded in the AWS-supplied aws:ssmmessages:target-id tag",
+    "type": "String"
   }
 }

package/data/conditionPatterns.json

@@ -57,6 +57,7 @@
     "license-manager:ResourceTag/.+?": "license-manager:ResourceTag/${TagKey}"
   },
   "ram": {
+    "ram:PermissionTemplateParameter/.+?": "ram:PermissionTemplateParameter/${ParameterName}",
     "ram:ResourceTag/.+?": "ram:ResourceTag/${TagKey}"
   },
   "secretsmanager": {

package/data/resourceTypes/athena.json

@@ -20,6 +20,13 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "system-table": {
+    "key": "system-table",
+    "arn": "arn:${Partition}:athena:${Region}:${Account}:system-table/${TableName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "workgroup": {
     "key": "workgroup",
     "arn": "arn:${Partition}:athena:${Region}:${Account}:workgroup/${WorkGroupName}",

package/data/resourceTypes/bedrock-agentcore.json

@@ -191,6 +191,10 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "web-answer": {
+    "key": "web-answer",
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:aws:tool/web-answer.v1"
+  },
   "web-search": {
     "key": "web-search",
     "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:tool/web-search.v1"

package/data/resourceTypes/cloudwatch.json

@@ -127,7 +127,7 @@
   },
   "view": {
     "key": "view",
-    "arn": "arn:${Partition}:cloudwatch:${Region}:${Account}:view/${ViewName}",
+    "arn": "arn:${Partition}:cloudwatch:${Region}:${Account}:view/${ViewName}/${ViewId}",
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]

package/data/resourceTypes/dynamodb.json

@@ -3,6 +3,10 @@
     "key": "backup",
     "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/backup/${BackupName}"
   },
+  "bulk-operation": {
+    "key": "bulk-operation",
+    "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:bulk-operation/${BulkOperationId}"
+  },
   "export": {
     "key": "export",
     "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/export/${ExportName}"

package/data/resourceTypes/payments.json

@@ -1,4 +1,11 @@
 {
+  "connectedaccount": {
+    "key": "connectedaccount",
+    "arn": "arn:${Partition}:payments::${Account}:connectedaccount/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "payment-instrument": {
     "key": "payment-instrument",
     "arn": "arn:${Partition}:payments::${Account}:payment-instrument:${ResourceId}",

package/data/resourceTypes/quicksight.json

@@ -1,4 +1,11 @@
 {
+  "accesscontrolapplication": {
+    "key": "accessControlApplication",
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:access-control-application/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "account": {
     "key": "account",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:account/${ResourceId}"
@@ -145,6 +152,13 @@
     "key": "group",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:group/${ResourceId}"
   },
+  "inboundconnector": {
+    "key": "inboundConnector",
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:inbound-connector/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "ingestion": {
     "key": "ingestion",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:dataset/${DatasetId}/ingestion/${ResourceId}",

package/data/resourceTypes/ram.json

@@ -5,12 +5,13 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}",
       "ram:PermissionArn",
-      "ram:PermissionResourceType"
+      "ram:PermissionResourceType",
+      "ram:ResourceTag/${TagKey}"
     ]
   },
   "permission": {
     "key": "permission",
-    "arn": "arn:${Partition}:ram::${Account}:permission/${ResourcePath}",
+    "arn": "arn:${Partition}:ram::aws:permission/${ResourcePath}",
     "conditionKeys": [
       "ram:PermissionArn",
       "ram:PermissionResourceType"
@@ -22,13 +23,16 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}",
       "ram:AllowsExternalPrincipals",
-      "ram:ResourceShareName"
+      "ram:ResourceShareName",
+      "ram:ResourceTag/${TagKey}",
+      "ram:RetainSharingOnAccountLeaveOrganization"
     ]
   },
   "resource-share-invitation": {
     "key": "resource-share-invitation",
     "arn": "arn:${Partition}:ram:${Region}:${Account}:resource-share-invitation/${ResourcePath}",
     "conditionKeys": [
+      "ram:ResourceShareName",
       "ram:ShareOwnerAccountId"
     ]
   }

package/data/resourceTypes/ssmmessages.json

@@ -1 +1,10 @@
-{}
+{
+  "session": {
+    "key": "session",
+    "arn": "arn:${Partition}:ssm:${Region}:${Account}:session/${SessionId}",
+    "conditionKeys": [
+      "ssm:resourceTag/aws:ssmmessages:session-id",
+      "ssm:resourceTag/aws:ssmmessages:target-id"
+    ]
+  }
+}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@actsecurity/iam-data",
-  "version": "0.22.202611051",
+  "version": "0.22.202611071",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/act-security-labs/iam-data.git"
   },
-  "updatedAt": "2026-11-05T04:41:37.248Z",
+  "updatedAt": "2026-11-07T04:41:44.234Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",