@cloud-copilot/iam-data 0.15.202511271 → 0.15.202512091

package/data/actions/s3tables.json

@@ -139,6 +139,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletetablebucketreplication": {
+    "name": "DeleteTableBucketReplication",
+    "description": "Grants permission to delete table bucket replication configuration on a bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "TableBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletetablepolicy": {
     "name": "DeleteTablePolicy",
     "description": "Grants permission to delete a policy on a table",
@@ -157,6 +172,24 @@
     ],
     "dependentActions": []
   },
+  "deletetablereplication": {
+    "name": "DeleteTableReplication",
+    "description": "Grants permission to delete table replication configuration on a table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
   "getnamespace": {
     "name": "GetNamespace",
     "description": "Grants permission to get a namespace",
@@ -252,6 +285,36 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "gettablebucketreplication": {
+    "name": "GetTableBucketReplication",
+    "description": "Grants permission to retrieve a table bucket replication configuration on a bucket",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "TableBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gettablebucketstorageclass": {
+    "name": "GetTableBucketStorageClass",
+    "description": "Grants permission to retrieve the storage class configuration for a table bucket",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "TableBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "gettabledata": {
     "name": "GetTableData",
     "isPermissionOnly": true,
@@ -361,6 +424,96 @@
     ],
     "dependentActions": []
   },
+  "gettablerecordexpirationconfiguration": {
+    "name": "GetTableRecordExpirationConfiguration",
+    "description": "Grants permission to retrieve a table maintenance configuration on a system table",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "gettablerecordexpirationjobstatus": {
+    "name": "GetTableRecordExpirationJobStatus",
+    "description": "Grants permission to retrieve the status of table record expiration jobs on a system table",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "gettablereplication": {
+    "name": "GetTableReplication",
+    "description": "Grants permission to retrieve a table replication configuration on a table",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "gettablereplicationstatus": {
+    "name": "GetTableReplicationStatus",
+    "description": "Grants permission to retrieve a table replication status on a table",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "gettablestorageclass": {
+    "name": "GetTableStorageClass",
+    "description": "Grants permission to retrieve the storage class configuration for a specific table",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
   "listnamespaces": {
     "name": "ListNamespaces",
     "description": "Grants permission to list namespaces",
@@ -403,7 +556,7 @@
   },
   "listtagsforresource": {
     "name": "ListTagsForResource",
-    "description": "Grants permission to list the tag for a S3Table's resource",
+    "description": "Grants permission to list the tags for an S3 Tables resource",
     "accessLevel": "List",
     "resourceTypes": [
       {
@@ -473,6 +626,38 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "puttablebucketreplication": {
+    "name": "PutTableBucketReplication",
+    "description": "Grants permission to put table bucket replication configuration on a bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "TableBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "puttablebucketstorageclass": {
+    "name": "PutTableBucketStorageClass",
+    "description": "Grants permission to set or update the storage class configuration for a table bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "TableBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:StorageClass"
+    ],
+    "dependentActions": []
+  },
   "puttabledata": {
     "name": "PutTableData",
     "isPermissionOnly": true,
@@ -548,6 +733,61 @@
     ],
     "dependentActions": []
   },
+  "puttablerecordexpirationconfiguration": {
+    "name": "PutTableRecordExpirationConfiguration",
+    "description": "Grants permission to put a table record expiration configuration on a system table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "puttablereplication": {
+    "name": "PutTableReplication",
+    "description": "Grants permission to put table replication configuration on a table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ],
+    "dependentActions": []
+  },
+  "puttablestorageclass": {
+    "name": "PutTableStorageClass",
+    "description": "Grants permission to set or update the storage class configuration for a table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Table",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName",
+      "s3tables:StorageClass"
+    ],
+    "dependentActions": []
+  },
   "renametable": {
     "name": "RenameTable",
     "description": "Grants permission to rename a table or move a table across namespaces",
@@ -568,7 +808,7 @@
   },
   "tagresource": {
     "name": "TagResource",
-    "description": "Grants permission to tag a S3Table's resource",
+    "description": "Grants permission to tag a S3 Tables resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
       {
@@ -594,7 +834,7 @@
   },
   "untagresource": {
     "name": "UntagResource",
-    "description": "Grants permission to untag a S3Table's resource",
+    "description": "Grants permission to untag a S3 Tables resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
       {

package/data/actions/s3vectors.json

@@ -11,7 +11,14 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "s3vectors:sseType",
+      "s3vectors:kmsKeyArn",
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "createvectorbucket": {
@@ -28,7 +35,11 @@
     ],
     "conditionKeys": [
       "s3vectors:sseType",
-      "s3vectors:kmsKeyArn"
+      "s3vectors:kmsKeyArn",
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -44,7 +55,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "deletevectorbucket": {
@@ -59,7 +73,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "deletevectorbucketpolicy": {
@@ -74,7 +91,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "deletevectors": {
@@ -89,7 +109,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getindex": {
@@ -104,7 +127,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getvectorbucket": {
@@ -119,7 +145,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getvectorbucketpolicy": {
@@ -134,7 +163,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getvectors": {
@@ -149,7 +181,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "listindexes": {
@@ -164,7 +199,34 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
+  "listtagsforresource": {
+    "name": "ListTagsForResource",
+    "description": "Grants permission to list tags for specified S3Vector resource",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "Index",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "VectorBucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "listvectorbuckets": {
@@ -184,13 +246,16 @@
         "name": "Index",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": []
+        "dependentActions": [
+          "s3vectors:GetVectors"
+        ]
       }
     ],
-    "conditionKeys": [],
-    "dependentActions": [
-      "s3vectors:GetVectors"
-    ]
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
   },
   "putvectorbucketpolicy": {
     "name": "PutVectorBucketPolicy",
@@ -204,7 +269,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "putvectors": {
@@ -219,7 +287,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "queryvectors": {
@@ -231,12 +302,66 @@
         "name": "Index",
         "required": true,
         "conditionKeys": [],
+        "dependentActions": [
+          "s3vectors:GetVectors"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
+  "tagresource": {
+    "name": "TagResource",
+    "description": "Grants permission to tag a S3Vector resource",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "Index",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "VectorBucket",
+        "required": false,
+        "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
-    "dependentActions": [
-      "s3vectors:GetVectors"
-    ]
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
+  "untagresource": {
+    "name": "UntagResource",
+    "description": "Grants permission to untag a S3Vector resource",
+    "accessLevel": "Tagging",
+    "resourceTypes": [
+      {
+        "name": "Index",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "VectorBucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
   }
 }

package/data/actions/sagemaker-unified-studio-mcp.json

@@ -1,6 +1,7 @@
 {
   "callprivilegedtool": {
     "name": "CallPrivilegedTool",
+    "isPermissionOnly": true,
     "description": "Grants permission to call privileged tools in MCP service",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -9,6 +10,7 @@
   },
   "callreadonlytool": {
     "name": "CallReadOnlyTool",
+    "isPermissionOnly": true,
     "description": "Grants permission to call read-only tools in MCP service",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -17,6 +19,7 @@
   },
   "invokemcp": {
     "name": "InvokeMcp",
+    "isPermissionOnly": true,
     "description": "Grants permission to use MCP service",
     "accessLevel": "Read",
     "resourceTypes": [],