@cloud-copilot/iam-data 0.15.202511061 → 0.15.202511081

package/data/actions/autoscaling.json

@@ -168,6 +168,7 @@
       }
     ],
     "conditionKeys": [
+      "autoscaling:ImageId",
       "autoscaling:CapacityReservationIds",
       "autoscaling:CapacityReservationResourceGroupArns",
       "autoscaling:InstanceTypes",
@@ -943,13 +944,15 @@
       {
         "name": "autoScalingGroup",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "autoscaling:ResourceTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "autoscaling:ResourceTag/${TagKey}",
-      "aws:ResourceTag/${TagKey}"
+      "autoscaling:ImageId"
     ],
     "dependentActions": []
   },
@@ -1007,6 +1010,7 @@
       }
     ],
     "conditionKeys": [
+      "autoscaling:ImageId",
       "autoscaling:CapacityReservationIds",
       "autoscaling:CapacityReservationResourceGroupArns",
       "autoscaling:InstanceTypes",

package/data/actions/batch.json

@@ -58,10 +58,7 @@
       {
         "name": "job-queue",
         "required": true,
-        "conditionKeys": [
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
-        ],
+        "conditionKeys": [],
         "dependentActions": []
       },
       {
@@ -83,7 +80,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createschedulingpolicy": {
@@ -412,7 +412,9 @@
       {
         "name": "job-definition",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
@@ -453,32 +455,39 @@
         "conditionKeys": [
           "batch:ShareIdentifier",
           "batch:EKSImage",
-          "batch:EKSNamespace",
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
+          "batch:EKSNamespace"
         ],
         "dependentActions": []
       },
       {
-        "name": "job-definition",
+        "name": "job-queue",
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "job-queue",
-        "required": true,
+        "name": "consumable-resource",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "consumable-resource",
+        "name": "job-definition",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "job-definition-revision",
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "submitservicejob": {
@@ -496,14 +505,15 @@
         "name": "service-job",
         "required": true,
         "conditionKeys": [
-          "batch:ShareIdentifier",
-          "aws:RequestTag/${TagKey}",
-          "aws:TagKeys"
+          "batch:ShareIdentifier"
         ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "tagresource": {

package/data/actions/guardduty.json

@@ -93,7 +93,11 @@
     "description": "Grants permission to create a publishing destination",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": [
       "s3:GetObject",
       "s3:ListBucket"
@@ -692,6 +696,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "publishingDestination",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "threatentityset",
         "required": false,
@@ -799,6 +809,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "publishingDestination",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "threatentityset",
         "required": false,
@@ -861,6 +877,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "publishingDestination",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "threatentityset",
         "required": false,

package/data/actions/profile.json

@@ -208,6 +208,30 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createrecommender": {
+    "name": "CreateRecommender",
+    "description": "Grants permission to create a Recommender in the domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createsegmentdefinition": {
     "name": "CreateSegmentDefinition",
     "description": "Grants permission to create a segment definition in the domain",
@@ -356,6 +380,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletedomainobjecttype": {
+    "name": "DeleteDomainObjectType",
+    "description": "Grants permission to delete a specific domain object type in the domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domain-object-types",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deleteeventstream": {
     "name": "DeleteEventStream",
     "description": "Grants permission to delete an event stream in a domain",
@@ -493,6 +538,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deleterecommender": {
+    "name": "DeleteRecommender",
+    "description": "Grants permission to delete a recommender in a domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletesegmentdefinition": {
     "name": "DeleteSegmentDefinition",
     "description": "Grants permission to delete a segment definition in the domain",
@@ -637,6 +703,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdomainobjecttype": {
+    "name": "GetDomainObjectType",
+    "description": "Grants permission to get a specific domain object type in the domain",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domain-object-types",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "geteventstream": {
     "name": "GetEventStream",
     "description": "Grants permission to get a specific event stream in a domain",
@@ -732,6 +819,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getobjecttypeattributestatistics": {
+    "name": "GetObjectTypeAttributeStatistics",
+    "description": "Grants permission to get statistics of a specific attribute for object type in the domain",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object-types",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getprofilehistoryrecord": {
     "name": "GetProfileHistoryRecord",
     "description": "Grants permission to get a profile history record for a profile in a domain",
@@ -747,6 +855,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getprofileinsights": {
+    "name": "GetProfileInsights",
+    "description": "Grants permission to list insights for a profile",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getprofileobjecttype": {
     "name": "GetProfileObjectType",
     "description": "Grants permission to get a specific profile object type in the domain",
@@ -776,6 +899,48 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getprofilerecommendations": {
+    "name": "GetProfileRecommendations",
+    "description": "Grants permission to list recommendations for a profile",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getrecommender": {
+    "name": "GetRecommender",
+    "description": "Grants permission to get Recommender details in a domain",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getsegmentdefinition": {
     "name": "GetSegmentDefinition",
     "description": "Grants permission to get a segment definition in the domain",
@@ -998,6 +1163,42 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdomainobjecttypes": {
+    "name": "ListDomainObjectTypes",
+    "description": "Grants permission to list all the domain object types in the domain",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdomainobjects": {
+    "name": "ListDomainObjects",
+    "description": "Grants permission to list domain objects in a domain",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "domain-object-types",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listdomains": {
     "name": "ListDomains",
     "description": "Grants permission to list all the domains in an account",
@@ -1066,6 +1267,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listobjecttypeattributevalues": {
+    "name": "ListObjectTypeAttributeValues",
+    "description": "Grants permission to list values of a specific attribute for object type in the domain",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object-types",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listobjecttypeattributes": {
     "name": "ListObjectTypeAttributes",
     "description": "Grants permission to list all the attributes of a specific object type in the domain",
@@ -1161,6 +1383,29 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listrecommenderrecipes": {
+    "name": "ListRecommenderRecipes",
+    "description": "Grants permission to list all the Recommenders Recipes in the domain",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listrecommenders": {
+    "name": "ListRecommenders",
+    "description": "Grants permission to list all the Recommenders in the domain",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listrulebasedmatches": {
     "name": "ListRuleBasedMatches",
     "description": "Grants permission to list all the rule-based matching result in the domain",
@@ -1202,6 +1447,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "domain-object-types",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "domains",
         "required": false,
@@ -1238,6 +1489,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "recommenders",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "segment-definitions",
         "required": false,
@@ -1293,6 +1550,30 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "putdomainobjecttype": {
+    "name": "PutDomainObjectType",
+    "description": "Grants permission to put a specific domain object type in the domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domain-object-types",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "putintegration": {
     "name": "PutIntegration",
     "description": "Grants permission to put a integration in a domain",
@@ -1383,6 +1664,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "startrecommender": {
+    "name": "StartRecommender",
+    "description": "Grants permission to start a recommender in a domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "startuploadjob": {
     "name": "StartUploadJob",
     "description": "Grants permission to start an upload job in the domain",
@@ -1398,6 +1700,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "stoprecommender": {
+    "name": "StopRecommender",
+    "description": "Grants permission to stop a recommender in a domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "stopuploadjob": {
     "name": "StopUploadJob",
     "description": "Grants permission to stop an upload job in the domain",
@@ -1424,6 +1747,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "domain-object-types",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "domains",
         "required": false,
@@ -1460,6 +1789,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "recommenders",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "segment-definitions",
         "required": false,
@@ -1484,6 +1819,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "domain-object-types",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "domains",
         "required": false,
@@ -1520,6 +1861,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "recommenders",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "segment-definitions",
         "required": false,
@@ -1626,5 +1973,26 @@
     ],
     "conditionKeys": [],
     "dependentActions": []
+  },
+  "updaterecommender": {
+    "name": "UpdateRecommender",
+    "description": "Grants permission to update a Recommender in the domain",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domains",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "recommenders",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
   }
 }

package/data/actions/s3tables.json

@@ -29,7 +29,11 @@
     "conditionKeys": [
       "s3tables:namespace",
       "s3tables:SSEAlgorithm",
-      "s3tables:KMSKeyArn"
+      "s3tables:KMSKeyArn",
+      "s3tables:TableBucketTag/${TagKey}",
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -47,7 +51,11 @@
     ],
     "conditionKeys": [
       "s3tables:SSEAlgorithm",
-      "s3tables:KMSKeyArn"
+      "s3tables:KMSKeyArn",
+      "s3tables:TableBucketTag/${TagKey}",
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -393,6 +401,30 @@
     ],
     "dependentActions": []
   },
+  "listtagsforresource": {
+    "name": "ListTagsForResource",
+    "description": "Grants permission to list the tag for a S3Table's resource",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "TableBucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3tables:TableBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "puttablebucketencryption": {
     "name": "PutTableBucketEncryption",
     "description": "Grants permission to put or overwrite encryption configuration on a table bucket",
@@ -534,6 +566,57 @@
     ],
     "dependentActions": []
   },
+  "tagresource": {
+    "name": "TagResource",
+    "description": "Grants permission to tag a S3Table's resource",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "TableBucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "s3tables:TableBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
+  "untagresource": {
+    "name": "UntagResource",
+    "description": "Grants permission to untag a S3Table's resource",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "TableBucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}",
+      "s3tables:TableBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "updatetablemetadatalocation": {
     "name": "UpdateTableMetadataLocation",
     "description": "Grants permission to update the metadata location of a table",

package/data/actions/sts.json

@@ -159,6 +159,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdelegatedaccesstoken": {
+    "name": "GetDelegatedAccessToken",
+    "description": "Returns temporary security credentials for accessing an AWS account after temporary delegation request approval. This API requires the tradeInToken provided upon request delegation approval and is intended to be used only by Amazon or AWS Partners",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getfederationtoken": {
     "name": "GetFederationToken",
     "description": "Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user",
@@ -203,6 +211,20 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getwebidentitytoken": {
+    "name": "GetWebIdentityToken",
+    "description": "Grants permission to obtain a short-lived, publicly verifiable JSON Web Token (JWT) that represents the calling IAM principal's identity",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "sts:DurationSeconds",
+      "sts:IdentityTokenAudience",
+      "sts:SigningAlgorithm",
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "setcontext": {
     "name": "SetContext",
     "isPermissionOnly": true,
@@ -252,6 +274,18 @@
     ],
     "dependentActions": []
   },
+  "taggetwebidentitytoken": {
+    "name": "TagGetWebIdentityToken",
+    "isPermissionOnly": true,
+    "description": "Grants permission to add tags to the JSON Web Token (JWT) generated by the GetWebIdentityToken API",
+    "accessLevel": "Tagging",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:RequestTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "tagsession": {
     "name": "TagSession",
     "isPermissionOnly": true,

package/data/actions/support-console.json

@@ -80,6 +80,24 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getissueclassificationpredictions": {
+    "name": "GetIssueClassificationPredictions",
+    "isPermissionOnly": true,
+    "description": "Grants permission to get classification predictions of an issue",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getissuetextsummary": {
+    "name": "GetIssueTextSummary",
+    "isPermissionOnly": true,
+    "description": "Grants permission to get a generated text summary of an issue",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getquestionnaire": {
     "name": "GetQuestionnaire",
     "isPermissionOnly": true,

package/data/actions/user-subscriptions.json

@@ -41,6 +41,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "setoverageconfig": {
+    "name": "SetOverageConfig",
+    "description": "Grants permission to set a User subscription overage configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updateclaim": {
     "name": "UpdateClaim",
     "description": "Grants permission to update a User subscription Claim",

package/data/actions/vpc-lattice.json

@@ -81,6 +81,12 @@
     "description": "Grants permission to create a resource configuration",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "DomainVerification",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "ResourceConfiguration",
         "required": false,
@@ -271,6 +277,8 @@
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
+      "vpc-lattice:PrivateDnsPreference",
+      "vpc-lattice:PrivateDnsSpecifiedDomains",
       "vpc-lattice:SecurityGroupIds",
       "vpc-lattice:ServiceNetworkArn",
       "vpc-lattice:VpcId"
@@ -348,6 +356,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletedomainverification": {
+    "name": "DeleteDomainVerification",
+    "description": "Grants permission to delete a domain verification",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "DomainVerification",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "deletelistener": {
     "name": "DeleteListener",
     "description": "Grants permission to delete a listener",
@@ -621,6 +646,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdomainverification": {
+    "name": "GetDomainVerification",
+    "description": "Grants permission to get information about a domain verification",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "DomainVerification",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "getlistener": {
     "name": "GetListener",
     "description": "Grants permission to get information about a listener",
@@ -830,6 +872,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdomainverifications": {
+    "name": "ListDomainVerifications",
+    "description": "Grants permission to list some or all domain verifications",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listlisteners": {
     "name": "ListListeners",
     "description": "Grants permission to list some or all listeners",
@@ -1021,6 +1071,25 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "startdomainverification": {
+    "name": "StartDomainVerification",
+    "description": "Grants permission to start a domain verification",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "DomainVerification",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "vpc-lattice:DomainName"
+    ],
+    "dependentActions": []
+  },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag a vpc-lattice resource",
@@ -1032,6 +1101,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "DomainVerification",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "Listener",
         "required": false,
@@ -1117,6 +1192,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "DomainVerification",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "Listener",
         "required": false,

package/data/conditionKeys/s3tables.json

@@ -1,4 +1,19 @@
 {
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
   "s3tables:kmskeyarn": {
     "key": "s3tables:KMSKeyArn",
     "description": "Filters access by the AWS KMS key ARN for the key used to encrypt a table",
@@ -9,6 +24,11 @@
     "description": "Filters access by the server-side encryption algorithm used to encrypt a table",
     "type": "String"
   },
+  "s3tables:tablebuckettag/${tagkey}": {
+    "key": "s3tables:TableBucketTag/${TagKey}",
+    "description": "Filters access by the tags associated with the table bucket",
+    "type": "String"
+  },
   "s3tables:namespace": {
     "key": "s3tables:namespace",
     "description": "Filters access by the namespaces created in the table bucket",

package/data/conditionKeys/sts.json

@@ -234,6 +234,11 @@
     "description": "Filters access by the unique identifier required when you assume a role in another account",
     "type": "String"
   },
+  "sts:identitytokenaudience": {
+    "key": "sts:IdentityTokenAudience",
+    "description": "Filters access by the audience that is passed in the request",
+    "type": "String"
+  },
   "sts:requestcontext/${contextkey}": {
     "key": "sts:RequestContext/${ContextKey}",
     "description": "Filters access by the session context key-value pairs embedded in the signed context assertion retrieved from a trusted context provider",
@@ -249,6 +254,11 @@
     "description": "Filters access by the role session name required when you assume a role",
     "type": "String"
   },
+  "sts:signingalgorithm": {
+    "key": "sts:SigningAlgorithm",
+    "description": "Filters access by the signing algorithm that is passed in the request",
+    "type": "String"
+  },
   "sts:sourceidentity": {
     "key": "sts:SourceIdentity",
     "description": "Filters access by the source identity that is passed in the request",

package/data/conditionKeys/vpc-lattice.json

@@ -19,6 +19,21 @@
     "description": "Filters access by the auth type specified in the request",
     "type": "String"
   },
+  "vpc-lattice:domainname": {
+    "key": "vpc-lattice:DomainName",
+    "description": "Filters access by the domain name",
+    "type": "String"
+  },
+  "vpc-lattice:privatednspreference": {
+    "key": "vpc-lattice:PrivateDnsPreference",
+    "description": "Filters access by the private dns preference",
+    "type": "String"
+  },
+  "vpc-lattice:privatednsspecifieddomains": {
+    "key": "vpc-lattice:PrivateDnsSpecifiedDomains",
+    "description": "Filters access by the private dns domains",
+    "type": "ArrayOfString"
+  },
   "vpc-lattice:protocol": {
     "key": "vpc-lattice:Protocol",
     "description": "Filters access by the protocol specified in the request",

package/data/conditionPatterns.json

@@ -113,6 +113,9 @@
     "s3express:AccessPointTag/.+?": "s3express:AccessPointTag/${TagKey}",
     "s3express:BucketTag/.+?": "s3express:BucketTag/${TagKey}"
   },
+  "s3tables": {
+    "s3tables:TableBucketTag/.+?": "s3tables:TableBucketTag/${TagKey}"
+  },
   "s3-outposts": {
     "s3-outposts:ExistingObjectTag/.+?": "s3-outposts:ExistingObjectTag/<key>",
     "s3-outposts:RequestObjectTag/.+?": "s3-outposts:RequestObjectTag/<key>"

package/data/resourceTypes/guardduty.json

@@ -43,7 +43,10 @@
   },
   "publishingdestination": {
     "key": "publishingDestination",
-    "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/publishingDestination/${PublishingDestinationId}"
+    "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/publishingdestination/${PublishingDestinationId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "malwareprotectionplan": {
     "key": "malwareprotectionplan",

package/data/resourceTypes/profile.json

@@ -54,5 +54,19 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "recommenders": {
+    "key": "recommenders",
+    "arn": "arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/recommenders/${RecommenderTypeName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "domain-object-types": {
+    "key": "domain-object-types",
+    "arn": "arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/domain-object-types/${ObjectTypeName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/s3tables.json

@@ -1,12 +1,18 @@
 {
   "tablebucket": {
     "key": "TableBucket",
-    "arn": "arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}"
+    "arn": "arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3tables:TableBucketTag/${TagKey}"
+    ]
   },
   "table": {
     "key": "Table",
     "arn": "arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}/table/${TableID}",
     "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3tables:TableBucketTag/${TagKey}",
       "s3tables:namespace",
       "s3tables:tableName"
     ]

package/data/resourceTypes/vpc-lattice.json

@@ -8,6 +8,16 @@
       "aws:TagKeys"
     ]
   },
+  "domainverification": {
+    "key": "DomainVerification",
+    "arn": "arn:${Partition}:vpc-lattice:${Region}:${Account}:domainverification/${DomainVerificationId}",
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys",
+      "vpc-lattice:DomainName"
+    ]
+  },
   "listener": {
     "key": "Listener",
     "arn": "arn:${Partition}:vpc-lattice:${Region}:${Account}:service/${ServiceId}/listener/${ListenerId}",
@@ -108,6 +118,8 @@
       "aws:RequestTag/${TagKey}",
       "aws:ResourceTag/${TagKey}",
       "aws:TagKeys",
+      "vpc-lattice:PrivateDnsPreference",
+      "vpc-lattice:PrivateDnsSpecifiedDomains",
       "vpc-lattice:SecurityGroupIds",
       "vpc-lattice:ServiceNetworkArn",
       "vpc-lattice:VpcId"

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.15.202511061",
+  "version": "0.15.202511081",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud-copilot/iam-data.git"
   },
-  "updatedAt": "2025-11-06T04:51:09.499Z",
+  "updatedAt": "2025-11-08T04:46:41.933Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",