@cloud-copilot/iam-data 0.15.202511271 → 0.15.202512091

package/data/actions/transform-custom.json

@@ -0,0 +1,274 @@
+{
+  "completetransformationpackageupload": {
+    "name": "CompleteTransformationPackageUpload",
+    "description": "Grants permission to invoke CompleteTransformationPackageUpload on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "conversestream": {
+    "name": "ConverseStream",
+    "description": "Grants permission to invoke ConverseStream on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createcampaign": {
+    "name": "CreateCampaign",
+    "description": "Grants permission to invoke CreateCampaign on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "campaign",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createtransformationpackageurl": {
+    "name": "CreateTransformationPackageUrl",
+    "description": "Grants permission to invoke CompleteTransformationPackageUrl on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletecampaign": {
+    "name": "DeleteCampaign",
+    "description": "Grants permission to invoke DeleteCampaign on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "campaign",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deleteknowledgeitem": {
+    "name": "DeleteKnowledgeItem",
+    "description": "Grants permission to invoke DeleteKnowledgeItem on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "knowledge-item",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletetransformationpackage": {
+    "name": "DeleteTransformationPackage",
+    "description": "Grants permission to invoke DeleteTransformationPackage on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "executetransformation": {
+    "name": "ExecuteTransformation",
+    "description": "Grants permission to invoke ExecuteTransformation on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcampaign": {
+    "name": "GetCampaign",
+    "description": "Grants permission to invoke GetCampaign on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "campaign",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getknowledgeitem": {
+    "name": "GetKnowledgeItem",
+    "description": "Grants permission to invoke GetKnowledgeItem on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "knowledge-item",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gettransformationpackageurl": {
+    "name": "GetTransformationPackageUrl",
+    "description": "Grants permission to invoke GetTransformationPackageUrl on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcampaignrepositories": {
+    "name": "ListCampaignRepositories",
+    "description": "Grants permission to invoke ListCampaignRepositories on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcampaigns": {
+    "name": "ListCampaigns",
+    "description": "Grants permission to invoke ListCampaign on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listknowledgeitems": {
+    "name": "ListKnowledgeItems",
+    "description": "Grants permission to invoke ListKnowledgeItems on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listtagsforresource": {
+    "name": "ListTagsForResource",
+    "description": "Grants permission to invoke ListTagsForResource on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listtransformationpackagemetadata": {
+    "name": "ListTransformationPackageMetadata",
+    "description": "Grants permission to invoke ListTransformationPackageMetadata on AWS Transform Custom",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "tagresource": {
+    "name": "TagResource",
+    "description": "Grants permission to invoke TagResource on AWS Transform Custom",
+    "accessLevel": "Tagging",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "untagresource": {
+    "name": "UntagResource",
+    "description": "Grants permission to invoke UntagResource on AWS Transform Custom",
+    "accessLevel": "Tagging",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "updatecampaign": {
+    "name": "UpdateCampaign",
+    "description": "Grants permission to invoke UpdateCampaign on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "campaign",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatecampaignrepositorystatus": {
+    "name": "UpdateCampaignRepositoryStatus",
+    "description": "Grants permission to invoke UpdateCampaignRepositories on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "campaign",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateknowledgeitemconfiguration": {
+    "name": "UpdateKnowledgeItemConfiguration",
+    "description": "Grants permission to invoke UpdateKnowledgeItemConfiguration on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateknowledgeitemstatus": {
+    "name": "UpdateKnowledgeItemStatus",
+    "description": "Grants permission to invoke UpdateKnowledgeItemStatus on AWS Transform Custom",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "knowledge-item",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  }
+}

package/data/actions/transform.json

@@ -31,6 +31,15 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deleteagentruntimeconfiguration": {
+    "name": "DeleteAgentRuntimeConfiguration",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke DeleteAgentRuntimeConfiguration on AWS Transform",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deleteconnector": {
     "name": "DeleteConnector",
     "isPermissionOnly": true,
@@ -63,6 +72,33 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getaccountsettings": {
+    "name": "GetAccountSettings",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke GetAccountSettings on AWS Transform",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getagent": {
+    "name": "GetAgent",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke GetAgent on AWS Transform",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getagentruntimeconfiguration": {
+    "name": "GetAgentRuntimeConfiguration",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke GetAgentRuntimeConfiguration on AWS Transform",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getconnector": {
     "name": "GetConnector",
     "isPermissionOnly": true,
@@ -79,6 +115,15 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listagents": {
+    "name": "ListAgents",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke ListAgents on AWS Transform",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listconnectors": {
     "name": "ListConnectors",
     "isPermissionOnly": true,
@@ -113,6 +158,15 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "putagentruntimeconfiguration": {
+    "name": "PutAgentRuntimeConfiguration",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke PutAgentRuntimeConfiguration on AWS Transform",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "rejectconnector": {
     "name": "RejectConnector",
     "isPermissionOnly": true,
@@ -166,6 +220,24 @@
     ],
     "dependentActions": []
   },
+  "updateaccountsettings": {
+    "name": "UpdateAccountSettings",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke UpdateAccountSettings on AWS Transform",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateagentaccess": {
+    "name": "UpdateAgentAccess",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke UpdateAgentAccess on AWS Transform",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updateprofile": {
     "name": "UpdateProfile",
     "isPermissionOnly": true,

package/data/actions/vpce.json

@@ -4,7 +4,20 @@
     "isPermissionOnly": true,
     "description": "Grants permission to manage multi-region VPC endpoints and VPC endpoint service configurations",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "vpc-endpoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "vpc-endpoint-service",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   }

package/data/conditionKeys/aco-automation.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/aidevops.json

@@ -0,0 +1,22 @@
+{
+  "aidevops:agentspaceresourceagentspaceid": {
+    "key": "aidevops:AgentSpaceResourceAgentSpaceId",
+    "description": "Filters access by unique identifier for an AgentSpace",
+    "type": "String"
+  },
+  "aidevops:associationresourceagentspaceid": {
+    "key": "aidevops:AssociationResourceAgentSpaceId",
+    "description": "Filters access by unique identifier for an AgentSpace",
+    "type": "String"
+  },
+  "aidevops:associationresourceassociationid": {
+    "key": "aidevops:AssociationResourceAssociationId",
+    "description": "Filters access by unique identifier for a service association within an AgentSpace",
+    "type": "String"
+  },
+  "aidevops:serviceresourceserviceid": {
+    "key": "aidevops:ServiceResourceServiceId",
+    "description": "Filters access by unique identifier for a registered service",
+    "type": "String"
+  }
+}

package/data/conditionKeys/aws-mcp.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/bedrock-agentcore.json

@@ -44,11 +44,6 @@
     "description": "Filters access by the subject claim (sub) in the JWT passed in the request",
     "type": "String"
   },
-  "bedrock-agentcore:kmskeyarn": {
-    "key": "bedrock-agentcore:KmsKeyArn",
-    "description": "Filters access by KMS Key arn provided",
-    "type": "String"
-  },
   "bedrock-agentcore:actorid": {
     "key": "bedrock-agentcore:actorId",
     "description": "Filters access by Actor Id",

package/data/conditionKeys/bedrock-mantle.json

@@ -0,0 +1,17 @@
+{
+  "bedrock-mantle:bearertokentype": {
+    "key": "bedrock-mantle:BearerTokenType",
+    "description": "Filters access by the Short-term or Long-term bearer tokens",
+    "type": "String"
+  },
+  "bedrock-mantle:model": {
+    "key": "bedrock-mantle:Model",
+    "description": "Filters access by the specified Model",
+    "type": "String"
+  },
+  "bedrock-mantle:servicetier": {
+    "key": "bedrock-mantle:ServiceTier",
+    "description": "Filters access by the specified ServiceTier",
+    "type": "String"
+  }
+}

package/data/conditionKeys/connect.json

@@ -39,6 +39,11 @@
     "description": "Filters access by restricting access to create contacts based on the initiation method of the contact",
     "type": "String"
   },
+  "connect:expressionvalue": {
+    "key": "connect:ExpressionValue",
+    "description": "Filters access by restricting data table operations based on expression type",
+    "type": "String"
+  },
   "connect:flowtype": {
     "key": "connect:FlowType",
     "description": "Filters access by Flow type",
@@ -69,6 +74,11 @@
     "description": "Filters access by PreferredUserArn",
     "type": "ARN"
   },
+  "connect:primaryattribute/${primaryattribute}": {
+    "key": "connect:PrimaryAttribute/${PrimaryAttribute}",
+    "description": "Filters access by restricting which primary attributes the user can manage",
+    "type": "String"
+  },
   "connect:searchcontactsbycontactanalysis": {
     "key": "connect:SearchContactsByContactAnalysis",
     "description": "Filters access by restricting searches using analysis outputs from Amazon Connect Contact Lens",

package/data/conditionKeys/nova-act.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/observabilityadmin.json

@@ -28,5 +28,10 @@
     "key": "observabilityadmin:CentralizationSourceRegions",
     "description": "Filters access by the source regions that are passed in the request",
     "type": "ArrayOfString"
+  },
+  "observabilityadmin:sourcetype": {
+    "key": "observabilityadmin:SourceType",
+    "description": "Filters access by the source type that is passed in the request",
+    "type": "String"
   }
 }

package/data/conditionKeys/partnercentral-account-management.json

@@ -1 +1,12 @@
-{}
+{
+  "partnercentral-account-management:legacypartnercentralrole": {
+    "key": "partnercentral-account-management:LegacyPartnerCentralRole",
+    "description": "Filters access by the Legacy Partner Central role",
+    "type": "ArrayOfString"
+  },
+  "partnercentral-account-management:marketingcentralrole": {
+    "key": "partnercentral-account-management:MarketingCentralRole",
+    "description": "Filters access by Marketing Central role",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/partnercentral.json

@@ -24,9 +24,24 @@
     "description": "Filters access by channel handshake types",
     "type": "String"
   },
+  "partnercentral:fulfillmenttypes": {
+    "key": "partnercentral:FulfillmentTypes",
+    "description": "Filters access by benefit fulfillment types",
+    "type": "ArrayOfString"
+  },
+  "partnercentral:programs": {
+    "key": "partnercentral:Programs",
+    "description": "Filters access by program",
+    "type": "ArrayOfString"
+  },
   "partnercentral:relatedentitytype": {
     "key": "partnercentral:RelatedEntityType",
     "description": "Filters access by entity types for Opportunity association",
     "type": "String"
+  },
+  "partnercentral:verificationtype": {
+    "key": "partnercentral:VerificationType",
+    "description": "Filters access by the type of verification being performed",
+    "type": "String"
   }
 }

package/data/conditionKeys/route53globalresolver.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair that is allowed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair of a resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by a list of tag keys that are allowed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/s3tables.json

@@ -24,6 +24,11 @@
     "description": "Filters access by the server-side encryption algorithm used to encrypt a table",
     "type": "String"
   },
+  "s3tables:storageclass": {
+    "key": "s3tables:StorageClass",
+    "description": "Filters access by the storage class that can be set on tables under a table bucket",
+    "type": "String"
+  },
   "s3tables:tablebuckettag/${tagkey}": {
     "key": "s3tables:TableBucketTag/${TagKey}",
     "description": "Filters access by the tags associated with the table bucket",

package/data/conditionKeys/s3vectors.json

@@ -1,4 +1,24 @@
 {
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  },
+  "s3vectors:vectorbuckettag/${tagkey}": {
+    "key": "s3vectors:VectorBucketTag/${TagKey}",
+    "description": "Filters access by the tags associated with the vector bucket",
+    "type": "String"
+  },
   "s3vectors:kmskeyarn": {
     "key": "s3vectors:kmsKeyArn",
     "description": "Filters access by the AWS KMS key ARN for the key used to encrypt a vector bucket",

package/data/conditionKeys/securityagent.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/transform-custom.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionPatterns.json

@@ -70,6 +70,7 @@
     "ssm:resourceTag/.+?": "ssm:resourceTag/${TagKey}"
   },
   "connect": {
+    "connect:PrimaryAttribute/.+?": "connect:PrimaryAttribute/${PrimaryAttribute}",
     "connect:SearchTag/.+?": "connect:SearchTag/${TagKey}"
   },
   "autoscaling": {
@@ -119,6 +120,9 @@
   "s3tables": {
     "s3tables:TableBucketTag/.+?": "s3tables:TableBucketTag/${TagKey}"
   },
+  "s3vectors": {
+    "s3vectors:VectorBucketTag/.+?": "s3vectors:VectorBucketTag/${TagKey}"
+  },
   "s3-outposts": {
     "s3-outposts:ExistingObjectTag/.+?": "s3-outposts:ExistingObjectTag/<key>",
     "s3-outposts:RequestObjectTag/.+?": "s3-outposts:RequestObjectTag/<key>"

package/data/resourceTypes/aco-automation.json

@@ -0,0 +1,9 @@
+{
+  "automationrule": {
+    "key": "AutomationRule",
+    "arn": "arn:${Partition}:compute-optimizer::${Account}:automation-rule/${RuleId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}