@cloud-copilot/iam-data 0.0.1

package/data/conditionKeys/ecr.json

@@ -0,0 +1,22 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  },
+  "ecr:ResourceTag/${TagKey}": {
+    "key": "ecr:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  }
+}

package/data/conditionKeys/ecs.json

@@ -0,0 +1,92 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
+  "ecs:CreateAction": {
+    "key": "ecs:CreateAction",
+    "description": "Filters access by the name of a resource-creating API action",
+    "type": "String"
+  },
+  "ecs:ResourceTag/${TagKey}": {
+    "key": "ecs:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "ecs:account-setting": {
+    "key": "ecs:account-setting",
+    "description": "Filters access by the Amazon ECS account setting name",
+    "type": "String"
+  },
+  "ecs:capacity-provider": {
+    "key": "ecs:capacity-provider",
+    "description": "Filters access by the ARN of an Amazon ECS capacity provider",
+    "type": "ARN"
+  },
+  "ecs:cluster": {
+    "key": "ecs:cluster",
+    "description": "Filters access by the ARN of an Amazon ECS cluster",
+    "type": "ARN"
+  },
+  "ecs:container-instances": {
+    "key": "ecs:container-instances",
+    "description": "Filters access by the ARN of an Amazon ECS container instance",
+    "type": "ARN"
+  },
+  "ecs:container-name": {
+    "key": "ecs:container-name",
+    "description": "Filters access by the name of an Amazon ECS container which is defined in the ECS task definition",
+    "type": "String"
+  },
+  "ecs:enable-ebs-volumes": {
+    "key": "ecs:enable-ebs-volumes",
+    "description": "Filters access by the Amazon ECS managed Amazon EBS volume capability of your ECS task or service",
+    "type": "String"
+  },
+  "ecs:enable-execute-command": {
+    "key": "ecs:enable-execute-command",
+    "description": "Filters access by the execute-command capability of your Amazon ECS task or Amazon ECS service",
+    "type": "String"
+  },
+  "ecs:enable-service-connect": {
+    "key": "ecs:enable-service-connect",
+    "description": "Filters access by the enable field value in the Service Connect configuration",
+    "type": "String"
+  },
+  "ecs:fargate-ephemeral-storage-kms-key": {
+    "key": "ecs:fargate-ephemeral-storage-kms-key",
+    "description": "Filters access by the AWS KMS key id provided in the request",
+    "type": "String"
+  },
+  "ecs:namespace": {
+    "key": "ecs:namespace",
+    "description": "Filters access by the ARN of AWS Cloud Map namespace which is defined in the Service Connect Configuration",
+    "type": "ARN"
+  },
+  "ecs:service": {
+    "key": "ecs:service",
+    "description": "Filters access by the ARN of an Amazon ECS service",
+    "type": "ARN"
+  },
+  "ecs:task": {
+    "key": "ecs:task",
+    "description": "Filters access by the ARN of an Amazon ECS task",
+    "type": "ARN"
+  },
+  "ecs:task-definition": {
+    "key": "ecs:task-definition",
+    "description": "Filters access by the ARN of an Amazon ECS task definition",
+    "type": "ARN"
+  }
+}

package/data/conditionKeys/eks-auth.json

@@ -0,0 +1,7 @@
+{
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  }
+}

package/data/conditionKeys/eks.json

@@ -0,0 +1,87 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a key that is present in the request the user makes to the EKS service",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the list of all the tag key names present in the request the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:accessEntryType": {
+    "key": "eks:accessEntryType",
+    "description": "Filters access by the access entry type present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:accessScope": {
+    "key": "eks:accessScope",
+    "description": "Filters access by the accessScope present in the associate / disassociate access policy requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:authenticationMode": {
+    "key": "eks:authenticationMode",
+    "description": "Filters access by the authenticationMode present in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:bootstrapClusterCreatorAdminPermissions": {
+    "key": "eks:bootstrapClusterCreatorAdminPermissions",
+    "description": "Filters access by the bootstrapClusterCreatorAdminPermissions present in the create cluster request",
+    "type": "Bool"
+  },
+  "eks:bootstrapSelfManagedAddons": {
+    "key": "eks:bootstrapSelfManagedAddons",
+    "description": "Filters access by the bootstrapSelfManagedAddons present in the create cluster request",
+    "type": "Bool"
+  },
+  "eks:clientId": {
+    "key": "eks:clientId",
+    "description": "Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:clusterName": {
+    "key": "eks:clusterName",
+    "description": "Filters access by the clusterName present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:issuerUrl": {
+    "key": "eks:issuerUrl",
+    "description": "Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service",
+    "type": "String"
+  },
+  "eks:kubernetesGroups": {
+    "key": "eks:kubernetesGroups",
+    "description": "Filters access by the kubernetesGroups present in the access entry requests the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:namespaces": {
+    "key": "eks:namespaces",
+    "description": "Filters access by the namespaces present in the associate / disassociate access policy requests the user makes to the EKS service",
+    "type": "ArrayOfString"
+  },
+  "eks:policyArn": {
+    "key": "eks:policyArn",
+    "description": "Filters access by the policyArn present in the access entry requests the user makes to the EKS service",
+    "type": "ARN"
+  },
+  "eks:principalArn": {
+    "key": "eks:principalArn",
+    "description": "Filters access by the principalArn present in the access entry requests requests the user makes to the EKS service",
+    "type": "ARN"
+  },
+  "eks:supportType": {
+    "key": "eks:supportType",
+    "description": "Filters access by the supportType present in the create / update cluster request",
+    "type": "String"
+  },
+  "eks:username": {
+    "key": "eks:username",
+    "description": "Filters access by the Kubernetes username present in the access entry requests the user makes to the EKS service",
+    "type": "String"
+  }
+}

package/data/conditionKeys/elastic-inference.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/elasticache.json

@@ -0,0 +1,107 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters actions based on the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters actions based on the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters actions based on the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticache:AtRestEncryptionEnabled": {
+    "key": "elasticache:AtRestEncryptionEnabled",
+    "description": "Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present",
+    "type": "Bool"
+  },
+  "elasticache:AuthTokenEnabled": {
+    "key": "elasticache:AuthTokenEnabled",
+    "description": "Filters access by the presence of non empty AuthToken parameter in the request",
+    "type": "Bool"
+  },
+  "elasticache:AutomaticFailoverEnabled": {
+    "key": "elasticache:AutomaticFailoverEnabled",
+    "description": "Filters access by the AutomaticFailoverEnabled parameter in the request",
+    "type": "Bool"
+  },
+  "elasticache:CacheNodeType": {
+    "key": "elasticache:CacheNodeType",
+    "description": "Filters access by the cacheNodeType parameter present in the request. This key can be used to restrict which cache node types can be used on cluster creation or scaling operations",
+    "type": "String"
+  },
+  "elasticache:CacheParameterGroupName": {
+    "key": "elasticache:CacheParameterGroupName",
+    "description": "Filters access by the CacheParameterGroupName parameter in the request",
+    "type": "String"
+  },
+  "elasticache:ClusterModeEnabled": {
+    "key": "elasticache:ClusterModeEnabled",
+    "description": "Filters access by the cluster mode parameter present in the request. Default value for single node group (shard) creations is false",
+    "type": "Bool"
+  },
+  "elasticache:DataStorageUnit": {
+    "key": "elasticache:DataStorageUnit",
+    "description": "Filters access by the CacheUsageLimits.DataStorage.Unit parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "String"
+  },
+  "elasticache:EngineType": {
+    "key": "elasticache:EngineType",
+    "description": "Filters access by the engine type present in creation requests. For replication group creations, default engine 'redis' is used as key if parameter is not present",
+    "type": "String"
+  },
+  "elasticache:EngineVersion": {
+    "key": "elasticache:EngineVersion",
+    "description": "Filters access by the engineVersion parameter present in creation or cluster modification requests",
+    "type": "String"
+  },
+  "elasticache:KmsKeyId": {
+    "key": "elasticache:KmsKeyId",
+    "description": "Filters access by the KmsKeyId parameter in the request",
+    "type": "String"
+  },
+  "elasticache:MaximumDataStorage": {
+    "key": "elasticache:MaximumDataStorage",
+    "description": "Filters access by the CacheUsageLimits.DataStorage.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:MaximumECPUPerSecond": {
+    "key": "elasticache:MaximumECPUPerSecond",
+    "description": "Filters access by the CacheUsageLimits.ECPUPerSecond.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request",
+    "type": "Numeric"
+  },
+  "elasticache:MultiAZEnabled": {
+    "key": "elasticache:MultiAZEnabled",
+    "description": "Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in",
+    "type": "Bool"
+  },
+  "elasticache:NumNodeGroups": {
+    "key": "elasticache:NumNodeGroups",
+    "description": "Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request. This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations",
+    "type": "Numeric"
+  },
+  "elasticache:ReplicasPerNodeGroup": {
+    "key": "elasticache:ReplicasPerNodeGroup",
+    "description": "Filters access by the number of replicas per node group (shards) specified in creations or scaling requests",
+    "type": "Numeric"
+  },
+  "elasticache:SnapshotRetentionLimit": {
+    "key": "elasticache:SnapshotRetentionLimit",
+    "description": "Filters access by the SnapshotRetentionLimit parameter in the request",
+    "type": "Numeric"
+  },
+  "elasticache:TransitEncryptionEnabled": {
+    "key": "elasticache:TransitEncryptionEnabled",
+    "description": "Filters access by the TransitEncryptionEnabled parameter present in the request. For replication group creations, default value 'false' is used as key if parameter is not present",
+    "type": "Bool"
+  },
+  "elasticache:UserAuthenticationMode": {
+    "key": "elasticache:UserAuthenticationMode",
+    "description": "Filters access by the UserAuthenticationMode parameter in the request",
+    "type": "String"
+  }
+}

package/data/conditionKeys/elasticbeanstalk.json

@@ -0,0 +1,52 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters actions based on the presence of tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters actions based on tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters actions based on the presence of tag keys in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticbeanstalk:FromApplication": {
+    "key": "elasticbeanstalk:FromApplication",
+    "description": "Filters access by an application as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:FromApplicationVersion": {
+    "key": "elasticbeanstalk:FromApplicationVersion",
+    "description": "Filters access by an application version as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:FromConfigurationTemplate": {
+    "key": "elasticbeanstalk:FromConfigurationTemplate",
+    "description": "Filters access by a configuration template as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:FromEnvironment": {
+    "key": "elasticbeanstalk:FromEnvironment",
+    "description": "Filters access by an environment as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:FromPlatform": {
+    "key": "elasticbeanstalk:FromPlatform",
+    "description": "Filters access by a platform as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:FromSolutionStack": {
+    "key": "elasticbeanstalk:FromSolutionStack",
+    "description": "Filters access by a solution stack as a dependency or a constraint on an input parameter",
+    "type": "ARN"
+  },
+  "elasticbeanstalk:InApplication": {
+    "key": "elasticbeanstalk:InApplication",
+    "description": "Filters access by the application that contains the resource that the action operates on",
+    "type": "ARN"
+  }
+}

package/data/conditionKeys/elasticfilesystem.json

@@ -0,0 +1,37 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair that is allowed in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair of a resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by a list of tag keys that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticfilesystem:AccessPointArn": {
+    "key": "elasticfilesystem:AccessPointArn",
+    "description": "Filters access by the ARN of the access point used to mount the file system",
+    "type": "ARN"
+  },
+  "elasticfilesystem:AccessedViaMountTarget": {
+    "key": "elasticfilesystem:AccessedViaMountTarget",
+    "description": "Filters access by whether the file system is accessed via mount targets",
+    "type": "Bool"
+  },
+  "elasticfilesystem:CreateAction": {
+    "key": "elasticfilesystem:CreateAction",
+    "description": "Filters access by the name of a resource-creating API action",
+    "type": "String"
+  },
+  "elasticfilesystem:Encrypted": {
+    "key": "elasticfilesystem:Encrypted",
+    "description": "Filters access by whether users can create only encrypted or unencrypted file systems",
+    "type": "Bool"
+  }
+}

package/data/conditionKeys/elasticloadbalancing.json

@@ -0,0 +1,57 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair that is allowed in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair of a resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by a list of tag keys that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticloadbalancing:CreateAction": {
+    "key": "elasticloadbalancing:CreateAction",
+    "description": "Filters access by the name of a resource-creating API action",
+    "type": "String"
+  },
+  "elasticloadbalancing:ListenerProtocol": {
+    "key": "elasticloadbalancing:ListenerProtocol",
+    "description": "Filters access by the listener protocols that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticloadbalancing:ResourceTag/${TagKey}": {
+    "key": "elasticloadbalancing:ResourceTag/${TagKey}",
+    "description": "Filters access by the preface string for a tag key and value pair that are attached to a resource",
+    "type": "String"
+  },
+  "elasticloadbalancing:Scheme": {
+    "key": "elasticloadbalancing:Scheme",
+    "description": "Filters access by the load balancer scheme that are allowed in the request",
+    "type": "String"
+  },
+  "elasticloadbalancing:SecurityGroup": {
+    "key": "elasticloadbalancing:SecurityGroup",
+    "description": "Filters access by the security-group IDs that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticloadbalancing:SecurityPolicy": {
+    "key": "elasticloadbalancing:SecurityPolicy",
+    "description": "Filters access by the SSL Security Policies that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticloadbalancing:Subnet": {
+    "key": "elasticloadbalancing:Subnet",
+    "description": "Filters access by the subnet IDs that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "elasticloadbalancing:ResourceTag/": {
+    "key": "elasticloadbalancing:ResourceTag/",
+    "description": "Filters access by the preface string for a tag key and value pair that are attached to a resource",
+    "type": "String"
+  }
+}

package/data/conditionKeys/elasticmapreduce.json

@@ -0,0 +1,32 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by whether the tag and value pair is provided with the action",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag and value pair associated with an Amazon EMR resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by whether the tag keys are provided with the action regardless of tag value",
+    "type": "ArrayOfString"
+  },
+  "elasticmapreduce:ExecutionRoleArn": {
+    "key": "elasticmapreduce:ExecutionRoleArn",
+    "description": "Filters access by whether the execution role ARN is provided with the action",
+    "type": "ARN"
+  },
+  "elasticmapreduce:RequestTag/${TagKey}": {
+    "key": "elasticmapreduce:RequestTag/${TagKey}",
+    "description": "Filters access by whether the tag and value pair is provided with the action",
+    "type": "String"
+  },
+  "elasticmapreduce:ResourceTag/${TagKey}": {
+    "key": "elasticmapreduce:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag and value pair associated with an Amazon EMR resource",
+    "type": "String"
+  }
+}

package/data/conditionKeys/elastictranscoder.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/elemental-activations.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/elemental-appliances-software.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/elemental-support-cases.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/elemental-support-content.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/emr-containers.json

@@ -0,0 +1,27 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs present in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys present in the request",
+    "type": "ArrayOfString"
+  },
+  "emr-containers:ExecutionRoleArn": {
+    "key": "emr-containers:ExecutionRoleArn",
+    "description": "Filters access by the execution role arn present in the request",
+    "type": "ARN"
+  },
+  "emr-containers:JobTemplateArn": {
+    "key": "emr-containers:JobTemplateArn",
+    "description": "Filters access by the job template arn present in the request",
+    "type": "ARN"
+  }
+}

package/data/conditionKeys/emr-serverless.json

@@ -0,0 +1,17 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the presence of tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the presence of tag keys in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/entityresolution.json

@@ -0,0 +1,17 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a key that is present in the request the user makes to the entity resolution service",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the list of all the tag key names present in the request the user makes to the entity resolution service",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/es.json

@@ -0,0 +1,17 @@
+{
+  "aws:RequestTag/${TagKey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access based on the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:ResourceTag/${TagKey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access based on the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:TagKeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access based on the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}