@cloud-copilot/iam-data 0.15.202511201 → 0.15.202511221

package/data/actions/ecs.json

@@ -42,6 +42,36 @@
     ],
     "dependentActions": []
   },
+  "createexpressgatewayservice": {
+    "name": "CreateExpressGatewayService",
+    "description": "Grants permission to create a new Amazon ECS Express Gateway service with cluster and task definition",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "service",
+        "required": true,
+        "conditionKeys": [
+          "ecs:cluster",
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": [
+          "ecs:RegisterTaskDefinition",
+          "iam:PassRole"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "ecs:task-definition",
+      "ecs:subnet",
+      "ecs:enable-ecs-managed-tags",
+      "ecs:propagate-tags",
+      "ecs:task-cpu",
+      "ecs:task-memory"
+    ],
+    "dependentActions": []
+  },
   "createservice": {
     "name": "CreateService",
     "description": "Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation",
@@ -160,6 +190,24 @@
     ],
     "dependentActions": []
   },
+  "deleteexpressgatewayservice": {
+    "name": "DeleteExpressGatewayService",
+    "description": "Grants permission to delete a specified Express Gateway service",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "service",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ecs:cluster",
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "deleteservice": {
     "name": "DeleteService",
     "description": "Grants permission to delete a specified service within a cluster",
@@ -291,6 +339,24 @@
     ],
     "dependentActions": []
   },
+  "describeexpressgatewayservice": {
+    "name": "DescribeExpressGatewayService",
+    "description": "Grants permission to describe the specified Express Gateway service",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "service",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ecs:cluster",
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "describeservicedeployments": {
     "name": "DescribeServiceDeployments",
     "description": "Grants permission to describe one or more of your service deployments",
@@ -1147,6 +1213,30 @@
     ],
     "dependentActions": []
   },
+  "updateexpressgatewayservice": {
+    "name": "UpdateExpressGatewayService",
+    "description": "Grants permission to modify the parameters of an Express Gateway service",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "service",
+        "required": true,
+        "conditionKeys": [
+          "ecs:cluster",
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ecs:subnet",
+      "ecs:enable-ecs-managed-tags",
+      "ecs:propagate-tags",
+      "ecs:task-cpu",
+      "ecs:task-memory"
+    ],
+    "dependentActions": []
+  },
   "updateservice": {
     "name": "UpdateService",
     "description": "Grants permission to modify the parameters of a service",

package/data/actions/glue.json

@@ -4042,6 +4042,42 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "renametable": {
+    "name": "RenameTable",
+    "description": "Grants permission to rename a table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "database",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "rootcatalog",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "catalog",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "glue:LakeFormationPermissions",
+      "glue:FederatedAuthorizationSource"
+    ],
+    "dependentActions": []
+  },
   "requestlogparsing": {
     "name": "RequestLogParsing",
     "description": "Grants permission to request log parsing for SparkUI",
@@ -4996,7 +5032,8 @@
       }
     ],
     "conditionKeys": [
-      "glue:LakeFormationPermissions"
+      "glue:LakeFormationPermissions",
+      "glue:FederatedAuthorizationSource"
     ],
     "dependentActions": []
   },

package/data/actions/guardduty.json

@@ -471,6 +471,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getmalwarescan": {
+    "name": "GetMalwareScan",
+    "description": "Grants permission to retrieve a malware scan's details",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getmalwarescansettings": {
     "name": "GetMalwareScanSettings",
     "description": "Grants permission to retrieve the malware scan settings",
@@ -643,6 +651,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listmalwarescans": {
+    "name": "ListMalwareScans",
+    "description": "Grants permission to retrieve a list of malware scans",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listmembers": {
     "name": "ListMembers",
     "description": "Grants permission to retrieve a list of GuardDuty member accounts associated with an administrator account",
@@ -748,6 +764,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "sendobjectmalwarescan": {
+    "name": "SendObjectMalwareScan",
+    "description": "Grants permission to initiate a new object malware scan",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "sendsecuritytelemetry": {
     "name": "SendSecurityTelemetry",
     "description": "Grants permission to send security telemetry for a specific GuardDuty account in a Region",

package/data/actions/iam.json

@@ -1,4 +1,19 @@
 {
+  "acceptdelegationrequest": {
+    "name": "AcceptDelegationRequest",
+    "description": "Accepts a delegation request resource, granting the requested temporary access",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "addclientidtoopenidconnectprovider": {
     "name": "AddClientIDToOpenIDConnectProvider",
     "description": "Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource",
@@ -46,6 +61,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "associatedelegationrequest": {
+    "name": "AssociateDelegationRequest",
+    "description": "Associates a delegation request resource with the calling identity",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "attachgrouppolicy": {
     "name": "AttachGroupPolicy",
     "description": "Grants permission to attach a managed policy to the specified IAM group",
@@ -137,6 +167,25 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createdelegationrequest": {
+    "name": "CreateDelegationRequest",
+    "description": "Creates an IAM delegation request resource for temporary access delegation",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "iam:DelegationDuration",
+      "iam:NotificationChannel",
+      "iam:TemplateArn"
+    ],
+    "dependentActions": []
+  },
   "creategroup": {
     "name": "CreateGroup",
     "description": "Grants permission to create a new group",
@@ -516,7 +565,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "iam:PermissionsBoundary"
+    ],
     "dependentActions": []
   },
   "deleterolepermissionsboundary": {
@@ -784,6 +835,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "disableoutboundwebidentityfederation": {
+    "name": "DisableOutboundWebIdentityFederation",
+    "description": "Disables the outbound identity federation feature for the callers account",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "enablemfadevice": {
     "name": "EnableMFADevice",
     "description": "Grants permission to enable an MFA device and associate it with the specified IAM user",
@@ -820,6 +879,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "enableoutboundwebidentityfederation": {
+    "name": "EnableOutboundWebIdentityFederation",
+    "description": "Enables the outbound identity federation feature for the callers account",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "generatecredentialreport": {
     "name": "GenerateCredentialReport",
     "description": "Grants permission to generate a credential report for the AWS account",
@@ -991,6 +1058,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdelegationrequest": {
+    "name": "GetDelegationRequest",
+    "description": "Retrieves information about a specific delegation request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getgroup": {
     "name": "GetGroup",
     "description": "Grants permission to retrieve a list of IAM users in the specified IAM group",
@@ -1021,6 +1103,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "gethumanreadablesummary": {
+    "name": "GetHumanReadableSummary",
+    "description": "Retrieves a human readable summary for a given entity. At this time, only delegation request are supported",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getinstanceprofile": {
     "name": "GetInstanceProfile",
     "description": "Grants permission to retrieve information about the specified instance profile, including the instance profile's path, GUID, ARN, and role",
@@ -1089,6 +1186,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getoutboundwebidentityfederationinfo": {
+    "name": "GetOutboundWebIdentityFederationInfo",
+    "description": "Retrieves the configuration information for the outbound identity federation feature for the callers account",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getpolicy": {
     "name": "GetPolicy",
     "description": "Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached",
@@ -1131,7 +1236,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "iam:PermissionsBoundary"
+    ],
     "dependentActions": []
   },
   "getrolepolicy": {
@@ -1331,6 +1438,16 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdelegationrequests": {
+    "name": "ListDelegationRequests",
+    "description": "Lists delegation requests based on the specified criteria",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "iam:DelegationRequestOwner"
+    ],
+    "dependentActions": []
+  },
   "listentitiesforpolicy": {
     "name": "ListEntitiesForPolicy",
     "description": "Grants permission to list all IAM identities to which the specified managed policy is attached",
@@ -1833,6 +1950,21 @@
     ],
     "dependentActions": []
   },
+  "rejectdelegationrequest": {
+    "name": "RejectDelegationRequest",
+    "description": "Rejects a delegation request, denying the requested temporary access",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "removeclientidfromopenidconnectprovider": {
     "name": "RemoveClientIDFromOpenIDConnectProvider",
     "description": "Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource",
@@ -1910,6 +2042,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "senddelegationtoken": {
+    "name": "SendDelegationToken",
+    "description": "Sends the exchange token for an accepted delegation request",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "delegation-request",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "setdefaultpolicyversion": {
     "name": "SetDefaultPolicyVersion",
     "description": "Grants permission to set the version of the specified policy as the policy's default version",
@@ -2307,7 +2454,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "iam:PermissionsBoundary"
+    ],
     "dependentActions": []
   },
   "updatecloudfrontpublickey": {
@@ -2375,7 +2524,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "iam:PermissionsBoundary"
+    ],
     "dependentActions": []
   },
   "updateroledescription": {
@@ -2390,7 +2541,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "iam:PermissionsBoundary"
+    ],
     "dependentActions": []
   },
   "updatesamlprovider": {