@cloud-copilot/iam-data 0.0.1

package/data/actions/cognito-idp.json

@@ -0,0 +1,1433 @@
+{
+  "AddCustomAttributes": {
+    "name": "AddCustomAttributes",
+    "description": "Grants permission to add user attributes to the user pool schema",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminAddUserToGroup": {
+    "name": "AdminAddUserToGroup",
+    "description": "Grants permission to add any user to any group",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminConfirmSignUp": {
+    "name": "AdminConfirmSignUp",
+    "description": "Grants permission to confirm any user's registration without a confirmation code",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminCreateUser": {
+    "name": "AdminCreateUser",
+    "description": "Grants permission to create new users and send welcome messages via email or SMS",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminDeleteUser": {
+    "name": "AdminDeleteUser",
+    "description": "Grants permission to delete any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminDeleteUserAttributes": {
+    "name": "AdminDeleteUserAttributes",
+    "description": "Grants permission to delete attributes from any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminDisableProviderForUser": {
+    "name": "AdminDisableProviderForUser",
+    "description": "Grants permission to unlink any user pool user from a third-party identity provider (IdP) user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminDisableUser": {
+    "name": "AdminDisableUser",
+    "description": "Grants permission to deactivate any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminEnableUser": {
+    "name": "AdminEnableUser",
+    "description": "Grants permission to activate any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminForgetDevice": {
+    "name": "AdminForgetDevice",
+    "description": "Grants permission to deregister any user's devices",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminGetDevice": {
+    "name": "AdminGetDevice",
+    "description": "Grants permission to get information about any user's devices",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminGetUser": {
+    "name": "AdminGetUser",
+    "description": "Grants permission to look up any user by user name",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminInitiateAuth": {
+    "name": "AdminInitiateAuth",
+    "description": "Grants permission to authenticate any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminLinkProviderForUser": {
+    "name": "AdminLinkProviderForUser",
+    "description": "Grants permission to link any user pool user to a third-party IdP user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminListDevices": {
+    "name": "AdminListDevices",
+    "description": "Grants permission to list any user's remembered devices",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminListGroupsForUser": {
+    "name": "AdminListGroupsForUser",
+    "description": "Grants permission to list the groups that any user belongs to",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminListUserAuthEvents": {
+    "name": "AdminListUserAuthEvents",
+    "description": "Grants permission to lists sign-in events for any user",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminRemoveUserFromGroup": {
+    "name": "AdminRemoveUserFromGroup",
+    "description": "Grants permission to remove any user from any group",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminResetUserPassword": {
+    "name": "AdminResetUserPassword",
+    "description": "Grants permission to reset any user's password",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminRespondToAuthChallenge": {
+    "name": "AdminRespondToAuthChallenge",
+    "description": "Grants permission to respond to an authentication challenge during the authentication of any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminSetUserMFAPreference": {
+    "name": "AdminSetUserMFAPreference",
+    "description": "Grants permission to set any user's preferred MFA method",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminSetUserPassword": {
+    "name": "AdminSetUserPassword",
+    "description": "Grants permission to set any user's password",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminSetUserSettings": {
+    "name": "AdminSetUserSettings",
+    "description": "Grants permission to set user settings for any user",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminUpdateAuthEventFeedback": {
+    "name": "AdminUpdateAuthEventFeedback",
+    "description": "Grants permission to update advanced security feedback for any user's authentication event",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminUpdateDeviceStatus": {
+    "name": "AdminUpdateDeviceStatus",
+    "description": "Grants permission to update the status of any user's remembered devices",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminUpdateUserAttributes": {
+    "name": "AdminUpdateUserAttributes",
+    "description": "Grants permission to updates any user's standard or custom attributes",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AdminUserGlobalSignOut": {
+    "name": "AdminUserGlobalSignOut",
+    "description": "Grants permission to sign out any user from all sessions",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AssociateSoftwareToken": {
+    "name": "AssociateSoftwareToken",
+    "description": "Grants permission to return a unique generated shared secret key code for the user",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "AssociateWebACL": {
+    "name": "AssociateWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to associate the user pool with an AWS WAF web ACL",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "webacl",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ChangePassword": {
+    "name": "ChangePassword",
+    "description": "Grants permission to change the password for a specified user in a user pool",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ConfirmDevice": {
+    "name": "ConfirmDevice",
+    "description": "Grants permission to confirm tracking of the device. This API call is the call that begins device tracking",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ConfirmForgotPassword": {
+    "name": "ConfirmForgotPassword",
+    "description": "Grants permission to allow a user to enter a confirmation code to reset a forgotten password",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ConfirmSignUp": {
+    "name": "ConfirmSignUp",
+    "description": "Grants permission to confirm registration of a user and handles the existing alias from a previous user",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateGroup": {
+    "name": "CreateGroup",
+    "description": "Grants permission to create new user pool groups",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateIdentityProvider": {
+    "name": "CreateIdentityProvider",
+    "description": "Grants permission to add identity providers to user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateResourceServer": {
+    "name": "CreateResourceServer",
+    "description": "Grants permission to create and configure scopes for OAuth 2.0 resource servers",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateUserImportJob": {
+    "name": "CreateUserImportJob",
+    "description": "Grants permission to create user CSV import jobs",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateUserPool": {
+    "name": "CreateUserPool",
+    "description": "Grants permission to create and set password policy for user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
+  "CreateUserPoolClient": {
+    "name": "CreateUserPoolClient",
+    "description": "Grants permission to create user pool app clients",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "CreateUserPoolDomain": {
+    "name": "CreateUserPoolDomain",
+    "description": "Grants permission to add user pool domains",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteGroup": {
+    "name": "DeleteGroup",
+    "description": "Grants permission to delete any empty user pool group",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteIdentityProvider": {
+    "name": "DeleteIdentityProvider",
+    "description": "Grants permission to delete any identity provider from user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteResourceServer": {
+    "name": "DeleteResourceServer",
+    "description": "Grants permission to delete any OAuth 2.0 resource server from user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteUser": {
+    "name": "DeleteUser",
+    "description": "Grants permission to allow a user to delete one's self",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteUserAttributes": {
+    "name": "DeleteUserAttributes",
+    "description": "Grants permission to delete the attributes for a user",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteUserPool": {
+    "name": "DeleteUserPool",
+    "description": "Grants permission to delete user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteUserPoolClient": {
+    "name": "DeleteUserPoolClient",
+    "description": "Grants permission to delete any user pool app client",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DeleteUserPoolDomain": {
+    "name": "DeleteUserPoolDomain",
+    "description": "Grants permission to delete any user pool domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeIdentityProvider": {
+    "name": "DescribeIdentityProvider",
+    "description": "Grants permission to describe any user pool identity provider",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeResourceServer": {
+    "name": "DescribeResourceServer",
+    "description": "Grants permission to describe any OAuth 2.0 resource server",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeRiskConfiguration": {
+    "name": "DescribeRiskConfiguration",
+    "description": "Grants permission to describe the risk configuration settings of user pools and app clients",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeUserImportJob": {
+    "name": "DescribeUserImportJob",
+    "description": "Grants permission to describe any user import job",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeUserPool": {
+    "name": "DescribeUserPool",
+    "description": "Grants permission to describe user pools",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeUserPoolClient": {
+    "name": "DescribeUserPoolClient",
+    "description": "Grants permission to describe any user pool app client",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DescribeUserPoolDomain": {
+    "name": "DescribeUserPoolDomain",
+    "description": "Grants permission to describe any user pool domain",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "DisassociateWebACL": {
+    "name": "DisassociateWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to disassociate the user pool with an AWS WAF web ACL",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ForgetDevice": {
+    "name": "ForgetDevice",
+    "description": "Grants permission to forget the specified device",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ForgotPassword": {
+    "name": "ForgotPassword",
+    "description": "Grants permission to send a message to the end user with a confirmation code that is required to change the user's password",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetCSVHeader": {
+    "name": "GetCSVHeader",
+    "description": "Grants permission to generate headers for a user import .csv file",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetDevice": {
+    "name": "GetDevice",
+    "description": "Grants permission to get the device",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetGroup": {
+    "name": "GetGroup",
+    "description": "Grants permission to describe a user pool group",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetIdentityProviderByIdentifier": {
+    "name": "GetIdentityProviderByIdentifier",
+    "description": "Grants permission to correlate a user pool IdP identifier to the IdP Name",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetLogDeliveryConfiguration": {
+    "name": "GetLogDeliveryConfiguration",
+    "description": "Grants permission to get the detailed activity logging configuration for a user pool",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetSigningCertificate": {
+    "name": "GetSigningCertificate",
+    "description": "Grants permission to look up signing certificates for user pools",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetUICustomization": {
+    "name": "GetUICustomization",
+    "description": "Grants permission to get UI customization information for the hosted UI of any app client",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetUser": {
+    "name": "GetUser",
+    "description": "Grants permission to get the user attributes and metadata for a user",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetUserAttributeVerificationCode": {
+    "name": "GetUserAttributeVerificationCode",
+    "description": "Grants permission to get the user attribute verification code for the specified attribute name",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetUserPoolMfaConfig": {
+    "name": "GetUserPoolMfaConfig",
+    "description": "Grants permission to look up the MFA configuration of user pools",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GetWebACLForResource": {
+    "name": "GetWebACLForResource",
+    "isPermissionOnly": true,
+    "description": "Grants permission to get the AWS WAF web ACL that is associated with an Amazon Cognito user pool",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "GlobalSignOut": {
+    "name": "GlobalSignOut",
+    "description": "Grants permission to sign out users from all devices",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "InitiateAuth": {
+    "name": "InitiateAuth",
+    "description": "Grants permission to initiate the authentication flow",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListDevices": {
+    "name": "ListDevices",
+    "description": "Grants permission to list the devices",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListGroups": {
+    "name": "ListGroups",
+    "description": "Grants permission to list all groups in user pools",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListIdentityProviders": {
+    "name": "ListIdentityProviders",
+    "description": "Grants permission to list all identity providers in user pools",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListResourceServers": {
+    "name": "ListResourceServers",
+    "description": "Grants permission to list all resource servers in user pools",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListResourcesForWebACL": {
+    "name": "ListResourcesForWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to list the user pools that are associated with an AWS WAF web ACL",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "webacl",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListTagsForResource": {
+    "name": "ListTagsForResource",
+    "description": "Grants permission to list the tags that are assigned to an Amazon Cognito user pool",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListUserImportJobs": {
+    "name": "ListUserImportJobs",
+    "description": "Grants permission to list all user import jobs",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListUserPoolClients": {
+    "name": "ListUserPoolClients",
+    "description": "Grants permission to list all app clients in user pools",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListUserPools": {
+    "name": "ListUserPools",
+    "description": "Grants permission to list all user pools",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListUsers": {
+    "name": "ListUsers",
+    "description": "Grants permission to list all user pool users",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ListUsersInGroup": {
+    "name": "ListUsersInGroup",
+    "description": "Grants permission to list the users in any group",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "ResendConfirmationCode": {
+    "name": "ResendConfirmationCode",
+    "description": "Grants permission to resend the confirmation (for confirmation of registration) to a specific user in the user pool",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "RespondToAuthChallenge": {
+    "name": "RespondToAuthChallenge",
+    "description": "Grants permission to respond to the authentication challenge",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "RevokeToken": {
+    "name": "RevokeToken",
+    "description": "Grants permission to revoke all of the access tokens generated by the specified refresh token",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetLogDeliveryConfiguration": {
+    "name": "SetLogDeliveryConfiguration",
+    "description": "Grants permission to set up or modify the detailed activity logging configuration of a user pool",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetRiskConfiguration": {
+    "name": "SetRiskConfiguration",
+    "description": "Grants permission to set risk configuration for user pools and app clients",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetUICustomization": {
+    "name": "SetUICustomization",
+    "description": "Grants permission to customize the hosted UI for any app client",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetUserMFAPreference": {
+    "name": "SetUserMFAPreference",
+    "description": "Grants permission to set MFA preference for the user in the userpool",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetUserPoolMfaConfig": {
+    "name": "SetUserPoolMfaConfig",
+    "description": "Grants permission to set user pool MFA configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SetUserSettings": {
+    "name": "SetUserSettings",
+    "description": "Grants permission to set the user settings like multi-factor authentication (MFA)",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "SignUp": {
+    "name": "SignUp",
+    "description": "Grants permission to register the user in the specified user pool and creates a user name, password, and user attributes",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "StartUserImportJob": {
+    "name": "StartUserImportJob",
+    "description": "Grants permission to start any user import job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "StopUserImportJob": {
+    "name": "StopUserImportJob",
+    "description": "Grants permission to stop any user import job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "TagResource": {
+    "name": "TagResource",
+    "description": "Grants permission to tag a user pool",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "UntagResource": {
+    "name": "UntagResource",
+    "description": "Grants permission to untag a user pool",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "UpdateAuthEventFeedback": {
+    "name": "UpdateAuthEventFeedback",
+    "description": "Grants permission to update the feedback for the user authentication event",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateDeviceStatus": {
+    "name": "UpdateDeviceStatus",
+    "description": "Grants permission to update the device status",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateGroup": {
+    "name": "UpdateGroup",
+    "description": "Grants permission to update the configuration of any group",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateIdentityProvider": {
+    "name": "UpdateIdentityProvider",
+    "description": "Grants permission to update the configuration of any user pool IdP",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateResourceServer": {
+    "name": "UpdateResourceServer",
+    "description": "Grants permission to update the configuration of any OAuth 2.0 resource server",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateUserAttributes": {
+    "name": "UpdateUserAttributes",
+    "description": "Grants permission to allow a user to update a specific attribute (one at a time)",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateUserPool": {
+    "name": "UpdateUserPool",
+    "description": "Grants permission to updates the configuration of user pools",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "UpdateUserPoolClient": {
+    "name": "UpdateUserPoolClient",
+    "description": "Grants permission to update any user pool client",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "UpdateUserPoolDomain": {
+    "name": "UpdateUserPoolDomain",
+    "description": "Grants permission to replace the certificate for any custom domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "VerifySoftwareToken": {
+    "name": "VerifySoftwareToken",
+    "description": "Grants permission to register a user's entered TOTP code and mark the user's software token MFA status as verified if successful",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "VerifyUserAttribute": {
+    "name": "VerifyUserAttribute",
+    "description": "Grants permission to verify a user attribute using a one time verification code",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  }
+}