@cloud-copilot/iam-data 0.15.202510251 → 0.15.202511061

package/data/actions/lambda.json

@@ -28,7 +28,8 @@
     ],
     "conditionKeys": [
       "lambda:Principal",
-      "lambda:FunctionUrlAuthType"
+      "lambda:FunctionUrlAuthType",
+      "lambda:InvokedViaFunctionUrl"
     ],
     "dependentActions": []
   },

package/data/actions/mediaconnect.json

@@ -34,7 +34,10 @@
     "description": "Grants permission to add media streams to any flow",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "addflowoutputs": {
@@ -42,7 +45,10 @@
     "description": "Grants permission to add outputs to any flow",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "addflowsources": {
@@ -50,7 +56,10 @@
     "description": "Grants permission to add sources to any flow",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "addflowvpcinterfaces": {
@@ -58,7 +67,10 @@
     "description": "Grants permission to add VPC interfaces to any flow",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "createbridge": {
@@ -74,7 +86,10 @@
     "description": "Grants permission to create flows",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "creategateway": {
@@ -236,7 +251,10 @@
     "description": "Grants permission to grant entitlements on any flow",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "listbridges": {
@@ -431,16 +449,71 @@
     "name": "TagResource",
     "description": "Grants permission to associate tags with resources",
     "accessLevel": "Tagging",
-    "resourceTypes": [],
-    "conditionKeys": [],
+    "resourceTypes": [
+      {
+        "name": "Entitlement",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Flow",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Output",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Source",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from resources",
     "accessLevel": "Tagging",
-    "resourceTypes": [],
-    "conditionKeys": [],
+    "resourceTypes": [
+      {
+        "name": "Entitlement",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Flow",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Output",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Source",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "updatebridge": {

package/data/actions/redshift-serverless.json

@@ -510,8 +510,8 @@
     "accessLevel": "List",
     "resourceTypes": [
       {
-        "name": "namespace",
-        "required": false,
+        "name": "recoveryPoint",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }

package/data/actions/rtbfabric.json

@@ -26,7 +26,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createlink": {
@@ -34,7 +37,10 @@
     "description": "Grants permission to create a new link between RTB applications",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createoutboundexternallink": {
@@ -49,7 +55,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createrequestergateway": {
@@ -57,7 +66,10 @@
     "description": "Grants permission to create a requester gateway",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createrespondergateway": {
@@ -65,7 +77,10 @@
     "description": "Grants permission to create a responder gateway",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "deleteinboundexternallink": {
@@ -270,10 +285,39 @@
     "name": "ListTagsForResource",
     "description": "Grants permission to list tags for a resource",
     "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [
-      "aws:ResourceTag/${TagKey}"
+    "resourceTypes": [
+      {
+        "name": "InboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Link",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "OutboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "RequesterGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "ResponderGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
     ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "rejectlink": {
@@ -295,10 +339,40 @@
     "name": "TagResource",
     "description": "Grants permission to assign one or more tags (key-value pairs) to the specified resource",
     "accessLevel": "Tagging",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "InboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Link",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "OutboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "RequesterGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "ResponderGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:ResourceTag/${TagKey}",
       "aws:TagKeys"
     ],
     "dependentActions": []
@@ -307,9 +381,39 @@
     "name": "UntagResource",
     "description": "Grants permission to remove a tag or tags from a resource",
     "accessLevel": "Tagging",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "InboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Link",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "OutboundExternalLink",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "RequesterGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "ResponderGateway",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [
-      "aws:ResourceTag/${TagKey}",
       "aws:TagKeys"
     ],
     "dependentActions": []

package/data/actions/support.json

@@ -175,6 +175,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "initiatelivecontactforcase": {
+    "name": "InitiateLiveContactForCase",
+    "description": "Grants permission to initiate a live contact on AWS Support Center. This is an internally managed function",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "putcaseattributes": {
     "name": "PutCaseAttributes",
     "description": "Grants permission to allow secondary services to attach attributes to AWS Support cases. This is an internally managed function",

package/data/actions/vpc-lattice-svcs.json

@@ -38,6 +38,8 @@
       "vpc-lattice-svcs:ServiceArn",
       "vpc-lattice-svcs:SourceVpc",
       "vpc-lattice-svcs:SourceVpcOwnerAccount",
+      "vpc-lattice-svcs:RequestMethod",
+      "vpc-lattice-svcs:RequestPath",
       "vpc-lattice-svcs:RequestHeader/${HeaderName}",
       "vpc-lattice-svcs:RequestQueryString/${QueryStringKey}"
     ],

package/data/conditionKeys/bedrock-agentcore.json

@@ -54,11 +54,6 @@
     "description": "Filters access by namespace",
     "type": "String"
   },
-  "bedrock-agentcore:securitygroups": {
-    "key": "bedrock-agentcore:securityGroups",
-    "description": "Filters access by the ID of security groups configured for the AgentCore runtime",
-    "type": "ArrayOfString"
-  },
   "bedrock-agentcore:sessionid": {
     "key": "bedrock-agentcore:sessionId",
     "description": "Filters access by Session Id",
@@ -69,11 +64,6 @@
     "description": "Filters access by Memory Strategy Id",
     "type": "String"
   },
-  "bedrock-agentcore:subnets": {
-    "key": "bedrock-agentcore:subnets",
-    "description": "Filters access by the ID of subnets configured for the AgentCore runtime",
-    "type": "ArrayOfString"
-  },
   "bedrock-agentcore:userid": {
     "key": "bedrock-agentcore:userid",
     "description": "Filters access by the static user ID value passed in the request",

package/data/conditionKeys/ec2.json

@@ -624,6 +624,11 @@
     "description": "Filters access by the ID of a VPC peering connection",
     "type": "String"
   },
+  "ec2:vpcemultiregion": {
+    "key": "ec2:VpceMultiRegion",
+    "description": "Filters access by multi region of the VPC endpoint service",
+    "type": "String"
+  },
   "ec2:vpceservicename": {
     "key": "ec2:VpceServiceName",
     "description": "Filters access by the name of the VPC endpoint service",
@@ -639,6 +644,16 @@
     "description": "Filters access by the private DNS name of the VPC endpoint service",
     "type": "String"
   },
+  "ec2:vpceserviceregion": {
+    "key": "ec2:VpceServiceRegion",
+    "description": "Filters access by the region of the VPC endpoint service",
+    "type": "String"
+  },
+  "ec2:vpcesupportedregion": {
+    "key": "ec2:VpceSupportedRegion",
+    "description": "Filters access by the supported region of the VPC endpoint service",
+    "type": "String"
+  },
   "ec2:transitgatewayattachmentid": {
     "key": "ec2:transitGatewayAttachmentId",
     "description": "Filters access by the ID of a transit gateway attachment",
@@ -673,20 +688,5 @@
     "key": "ec2:transitGatewayRouteTableId",
     "description": "Filters access by the ID of a transit gateway route table",
     "type": "String"
-  },
-  "ec2:vpcemultiregion": {
-    "key": "ec2:vpceMultiRegion",
-    "description": "Filters access by multi region of the VPC endpoint service",
-    "type": "String"
-  },
-  "ec2:vpceserviceregion": {
-    "key": "ec2:vpceServiceRegion",
-    "description": "Filters access by the region of the VPC endpoint service",
-    "type": "String"
-  },
-  "ec2:vpcesupportedregion": {
-    "key": "ec2:vpceSupportedRegion",
-    "description": "Filters access by the supported region of the VPC endpoint service",
-    "type": "String"
   }
 }

package/data/conditionKeys/lambda.json

@@ -34,6 +34,11 @@
     "description": "Filters access by authorization type specified in request. Available during CreateFunctionUrlConfig, UpdateFunctionUrlConfig, DeleteFunctionUrlConfig, GetFunctionUrlConfig, ListFunctionUrlConfig, AddPermission and RemovePermission operations",
     "type": "String"
   },
+  "lambda:invokedviafunctionurl": {
+    "key": "lambda:InvokedViaFunctionUrl",
+    "description": "Limits the scope of lambda:InvokeFunction action to Function URLs only. Available during AddPermission operation",
+    "type": "Bool"
+  },
   "lambda:layer": {
     "key": "lambda:Layer",
     "description": "Filters access by the ARN of a version of an AWS Lambda layer",

package/data/conditionKeys/mediaconnect.json

@@ -1 +1,17 @@
-{}
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/vpc-lattice-svcs.json

@@ -14,6 +14,11 @@
     "description": "Filters access by the method of the request",
     "type": "String"
   },
+  "vpc-lattice-svcs:requestpath": {
+    "key": "vpc-lattice-svcs:RequestPath",
+    "description": "Filters access by the path portion of the request URL",
+    "type": "String"
+  },
   "vpc-lattice-svcs:requestquerystring/${querystringkey}": {
     "key": "vpc-lattice-svcs:RequestQueryString/${QueryStringKey}",
     "description": "Filters access by the query string key-value pairs in the request URL",

package/data/resourceTypes/aps.json

@@ -17,6 +17,15 @@
       "aws:TagKeys"
     ]
   },
+  "anomalydetector": {
+    "key": "anomalydetector",
+    "arn": "arn:${Partition}:aps:${Region}:${Account}:anomalydetector/${WorkspaceId}/${AnomalyDetectorId}",
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ]
+  },
   "scraper": {
     "key": "scraper",
     "arn": "arn:${Partition}:aps:${Region}:${Account}:scraper/${ScraperId}",

package/data/resourceTypes/bedrock.json

@@ -3,6 +3,10 @@
     "key": "foundation-model",
     "arn": "arn:${Partition}:bedrock:${Region}::foundation-model/${ResourceId}"
   },
+  "system-tool": {
+    "key": "system-tool",
+    "arn": "arn:${Partition}:bedrock::${Account}:system-tool/${ResourceId}"
+  },
   "async-invoke": {
     "key": "async-invoke",
     "arn": "arn:${Partition}:bedrock:${Region}:${Account}:async-invoke/${ResourceId}",

package/data/resourceTypes/ec2.json

@@ -28,6 +28,19 @@
       "ec2:ResourceTag/${TagKey}"
     ]
   },
+  "capacity-manager-data-export": {
+    "key": "capacity-manager-data-export",
+    "arn": "arn:${Partition}:ec2:${Region}:${Account}:capacity-manager-data-export/${CapacityManagerDataExportId}",
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys",
+      "ec2:Attribute",
+      "ec2:Attribute/${AttributeName}",
+      "ec2:Region",
+      "ec2:ResourceTag/${TagKey}"
+    ]
+  },
   "capacity-reservation-fleet": {
     "key": "capacity-reservation-fleet",
     "arn": "arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation-fleet/${CapacityReservationFleetId}",
@@ -1163,6 +1176,7 @@
       "ec2:LaunchTemplate",
       "ec2:ManagedResourceOperator",
       "ec2:ParentSnapshot",
+      "ec2:ParentVolume",
       "ec2:Region",
       "ec2:ResourceTag/${TagKey}",
       "ec2:VolumeID",
@@ -1208,10 +1222,10 @@
       "ec2:Attribute/${AttributeName}",
       "ec2:Region",
       "ec2:ResourceTag/${TagKey}",
+      "ec2:VpceMultiRegion",
       "ec2:VpceServiceName",
       "ec2:VpceServiceOwner",
-      "ec2:vpceMultiRegion",
-      "ec2:vpceServiceRegion"
+      "ec2:VpceServiceRegion"
     ]
   },
   "vpc-endpoint-service": {
@@ -1225,10 +1239,10 @@
       "ec2:Attribute/${AttributeName}",
       "ec2:Region",
       "ec2:ResourceTag/${TagKey}",
+      "ec2:VpceMultiRegion",
       "ec2:VpceServicePrivateDnsName",
-      "ec2:vpceMultiRegion",
-      "ec2:vpceServiceRegion",
-      "ec2:vpceSupportedRegion"
+      "ec2:VpceServiceRegion",
+      "ec2:VpceSupportedRegion"
     ]
   },
   "vpc-endpoint-service-permission": {

package/data/resourceTypes/mediaconnect.json

@@ -1,19 +1,31 @@
 {
   "entitlement": {
     "key": "Entitlement",
-    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:entitlement:${FlowId}:${EntitlementName}"
+    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:entitlement:${FlowId}:${EntitlementName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "flow": {
     "key": "Flow",
-    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:flow:${FlowId}:${FlowName}"
+    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:flow:${FlowId}:${FlowName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "output": {
     "key": "Output",
-    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:output:${OutputId}:${OutputName}"
+    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:output:${OutputId}:${OutputName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "source": {
     "key": "Source",
-    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:source:${SourceId}:${SourceName}"
+    "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:source:${SourceId}:${SourceName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "gateway": {
     "key": "Gateway",

package/data/resourceTypes/rtbfabric.json

@@ -3,6 +3,7 @@
     "key": "InboundExternalLink",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
       "rtbfabric:InboundExternalLinkLinkId",
       "rtbfabric:ResponderGatewayGatewayId"
     ]
@@ -11,6 +12,7 @@
     "key": "Link",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
       "rtbfabric:LinkLinkId",
       "rtbfabric:RequesterGatewayGatewayId",
       "rtbfabric:ResponderGatewayGatewayId"
@@ -20,6 +22,7 @@
     "key": "OutboundExternalLink",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
       "rtbfabric:OutboundExternalLinkLinkId",
       "rtbfabric:RequesterGatewayGatewayId"
     ]
@@ -28,6 +31,7 @@
     "key": "RequesterGateway",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
       "rtbfabric:RequesterGatewayGatewayId"
     ]
   },
@@ -35,6 +39,7 @@
     "key": "ResponderGateway",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
       "rtbfabric:ResponderGatewayGatewayId"
     ]
   }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.15.202510251",
+  "version": "0.15.202511061",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud-copilot/iam-data.git"
   },
-  "updatedAt": "2025-10-25T04:45:09.053Z",
+  "updatedAt": "2025-11-06T04:51:09.499Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",