@cloud-copilot/iam-data 0.15.202510281 → 0.15.202511081

package/data/actions/aps.json

@@ -33,6 +33,24 @@
     ],
     "dependentActions": []
   },
+  "createanomalydetector": {
+    "name": "CreateAnomalyDetector",
+    "description": "Grants permission to create an anomaly detector",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "createloggingconfiguration": {
     "name": "CreateLoggingConfiguration",
     "description": "Grants permission to create a logging configuration",
@@ -161,6 +179,29 @@
     ],
     "dependentActions": []
   },
+  "deleteanomalydetector": {
+    "name": "DeleteAnomalyDetector",
+    "description": "Grants permission to delete an anomaly detector",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "deleteloggingconfiguration": {
     "name": "DeleteLoggingConfiguration",
     "description": "Grants permission to delete a logging configuration",
@@ -246,6 +287,23 @@
     ],
     "dependentActions": []
   },
+  "deletescraperloggingconfiguration": {
+    "name": "DeleteScraperLoggingConfiguration",
+    "description": "Grants permission to delete a scraper logging configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "scraper",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "deleteworkspace": {
     "name": "DeleteWorkspace",
     "description": "Grants permission to delete a workspace",
@@ -280,6 +338,29 @@
     ],
     "dependentActions": []
   },
+  "describeanomalydetector": {
+    "name": "DescribeAnomalyDetector",
+    "description": "Grants permission to describe an anomaly detector",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "describeloggingconfiguration": {
     "name": "DescribeLoggingConfiguration",
     "description": "Grants permission to describe a logging configuration",
@@ -365,6 +446,23 @@
     ],
     "dependentActions": []
   },
+  "describescraperloggingconfiguration": {
+    "name": "DescribeScraperLoggingConfiguration",
+    "description": "Grants permission to describe a scraper logging configuration",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "scraper",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "describeworkspace": {
     "name": "DescribeWorkspace",
     "description": "Grants permission to describe a workspace",
@@ -577,6 +675,23 @@
     ],
     "dependentActions": []
   },
+  "listanomalydetectors": {
+    "name": "ListAnomalyDetectors",
+    "description": "Grants permission to list anomaly detectors",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "listrulegroupsnamespaces": {
     "name": "ListRuleGroupsNamespaces",
     "description": "Grants permission to list rule groups namespaces",
@@ -624,6 +739,12 @@
     "description": "Grants permission to list tags on an AMP resource",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "rulegroupsnamespace",
         "required": false,
@@ -657,6 +778,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "previewanomalydetector": {
+    "name": "PreviewAnomalyDetector",
+    "description": "Grants permission to preview anomaly detection on AMP workspace metrics",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "putalertmanagerdefinition": {
     "name": "PutAlertManagerDefinition",
     "description": "Grants permission to update an alert manager definition",
@@ -691,6 +829,29 @@
     ],
     "dependentActions": []
   },
+  "putanomalydetector": {
+    "name": "PutAnomalyDetector",
+    "description": "Grants permission to update an anomaly detector",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workspace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "putresourcepolicy": {
     "name": "PutResourcePolicy",
     "description": "Grants permission to create and update workspace resource policy",
@@ -764,6 +925,12 @@
     "description": "Grants permission to tag an AMP resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "rulegroupsnamespace",
         "required": false,
@@ -794,6 +961,12 @@
     "description": "Grants permission to untag an AMP resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "anomalydetector",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "rulegroupsnamespace",
         "required": false,
@@ -878,6 +1051,23 @@
     ],
     "dependentActions": []
   },
+  "updatescraperloggingconfiguration": {
+    "name": "UpdateScraperLoggingConfiguration",
+    "description": "Grants permission to put a scraper logging configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "scraper",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "updateworkspacealias": {
     "name": "UpdateWorkspaceAlias",
     "description": "Grants permission to modify the alias of existing AMP workspace",

package/data/actions/autoscaling.json

@@ -168,6 +168,7 @@
       }
     ],
     "conditionKeys": [
+      "autoscaling:ImageId",
       "autoscaling:CapacityReservationIds",
       "autoscaling:CapacityReservationResourceGroupArns",
       "autoscaling:InstanceTypes",
@@ -716,6 +717,24 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "launchinstances": {
+    "name": "LaunchInstances",
+    "description": "Grants permission to launch one or more EC2 instances in the specified Auto Scaling group",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "autoScalingGroup",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "autoscaling:ResourceTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "putlifecyclehook": {
     "name": "PutLifecycleHook",
     "description": "Grants permission to create or update a lifecycle hook for the specified Auto Scaling Group",
@@ -925,13 +944,15 @@
       {
         "name": "autoScalingGroup",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "autoscaling:ResourceTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "autoscaling:ResourceTag/${TagKey}",
-      "aws:ResourceTag/${TagKey}"
+      "autoscaling:ImageId"
     ],
     "dependentActions": []
   },
@@ -989,6 +1010,7 @@
       }
     ],
     "conditionKeys": [
+      "autoscaling:ImageId",
       "autoscaling:CapacityReservationIds",
       "autoscaling:CapacityReservationResourceGroupArns",
       "autoscaling:InstanceTypes",

package/data/actions/batch.json

@@ -58,10 +58,7 @@
       {
         "name": "job-queue",
         "required": true,
-        "conditionKeys": [
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
-        ],
+        "conditionKeys": [],
         "dependentActions": []
       },
       {
@@ -83,7 +80,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createschedulingpolicy": {
@@ -412,7 +412,9 @@
       {
         "name": "job-definition",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
@@ -453,32 +455,39 @@
         "conditionKeys": [
           "batch:ShareIdentifier",
           "batch:EKSImage",
-          "batch:EKSNamespace",
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
+          "batch:EKSNamespace"
         ],
         "dependentActions": []
       },
       {
-        "name": "job-definition",
+        "name": "job-queue",
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "job-queue",
-        "required": true,
+        "name": "consumable-resource",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "consumable-resource",
+        "name": "job-definition",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "job-definition-revision",
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "submitservicejob": {
@@ -496,14 +505,15 @@
         "name": "service-job",
         "required": true,
         "conditionKeys": [
-          "batch:ShareIdentifier",
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
+          "batch:ShareIdentifier"
         ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "tagresource": {

package/data/actions/bedrock-agentcore.json

@@ -127,9 +127,7 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys",
-      "bedrock-agentcore:subnets",
-      "bedrock-agentcore:securityGroups"
+      "aws:TagKeys"
     ],
     "dependentActions": [
       "iam:PassRole"
@@ -184,9 +182,7 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys",
-      "bedrock-agentcore:subnets",
-      "bedrock-agentcore:securityGroups"
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -197,9 +193,7 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys",
-      "bedrock-agentcore:subnets",
-      "bedrock-agentcore:securityGroups"
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -1642,16 +1636,13 @@
         "name": "runtime",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:PassRole"
-        ]
+        "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "bedrock-agentcore:subnets",
-      "bedrock-agentcore:securityGroups"
-    ],
-    "dependentActions": []
+    "conditionKeys": [],
+    "dependentActions": [
+      "iam:PassRole"
+    ]
   },
   "updateagentruntimeendpoint": {
     "name": "UpdateAgentRuntimeEndpoint",

package/data/actions/bedrock.json

@@ -2332,6 +2332,21 @@
     ],
     "dependentActions": []
   },
+  "invoketool": {
+    "name": "InvokeTool",
+    "description": "Grants permission to invoke the specified Bedrock tool to run inference",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "system-tool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listagentactiongroups": {
     "name": "ListAgentActionGroups",
     "description": "Grants permission to list action groups in an agent",