@cloud-copilot/iam-data 0.19.202605131 → 0.19.202605151

package/data/actions/bedrock-agentcore.json

@@ -503,7 +503,10 @@
     "description": "Grants permission to create a new policy engine",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createregistry": {
@@ -1604,6 +1607,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getpolicyenginesummary": {
+    "name": "GetPolicyEngineSummary",
+    "description": "Grants permission to retrieve a summary of a policy engine",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getpolicygeneration": {
     "name": "GetPolicyGeneration",
     "description": "Grants permission to retrieve status and results of a policy generation request",
@@ -1625,6 +1643,48 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getpolicygenerationsummary": {
+    "name": "GetPolicyGenerationSummary",
+    "description": "Grants permission to retrieve a summary of a policy generation request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-generation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getpolicysummary": {
+    "name": "GetPolicySummary",
+    "description": "Grants permission to retrieve a summary of a policy",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "policy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getrecommendation": {
     "name": "GetRecommendation",
     "description": "Grants permission to get details of a recommendation",
@@ -2460,6 +2520,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listpolicyenginesummaries": {
+    "name": "ListPolicyEngineSummaries",
+    "description": "Grants permission to list policy engine summaries",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listpolicyengines": {
     "name": "ListPolicyEngines",
     "description": "Grants permission to list policy engines",
@@ -2489,6 +2557,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listpolicygenerationsummaries": {
+    "name": "ListPolicyGenerationSummaries",
+    "description": "Grants permission to list policy generation summaries",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listpolicygenerations": {
     "name": "ListPolicyGenerations",
     "description": "Grants permission to list policy generation requests",
@@ -2504,6 +2587,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listpolicysummaries": {
+    "name": "ListPolicySummaries",
+    "description": "Grants permission to list policy summaries within a policy engine",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "policy-engine",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listrecommendations": {
     "name": "ListRecommendations",
     "description": "Grants permission to list recommendations",
@@ -2629,6 +2727,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,
@@ -3132,6 +3236,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,
@@ -3246,6 +3356,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "policy-engine",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,

package/data/actions/cloudfront.json

@@ -181,7 +181,10 @@
     "description": "Grants permission to create a CloudFront function",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createinvalidation": {
@@ -227,7 +230,10 @@
     "description": "Grants permission to create a CloudFront KeyValueStore",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createmonitoringsubscription": {
@@ -1676,6 +1682,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "function",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "key-value-store",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "trust-store",
         "required": false,
@@ -1797,6 +1815,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "function",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "key-value-store",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "streaming-distribution",
         "required": false,
@@ -1887,6 +1917,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "function",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "key-value-store",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "streaming-distribution",
         "required": false,

package/data/actions/dsql.json

@@ -38,6 +38,26 @@
     ],
     "dependentActions": []
   },
+  "createstream": {
+    "name": "CreateStream",
+    "description": "Grants permission to create a Change Stream for a cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "iam:PassRole"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "dbconnect": {
     "name": "DbConnect",
     "description": "Grants permission to connect to the database",
@@ -98,6 +118,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletestream": {
+    "name": "DeleteStream",
+    "description": "Grants permission to delete a Change Stream",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Stream",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getbackupjob": {
     "name": "GetBackupJob",
     "description": "Grants permission to get the status of an Aurora DSQL cluster backup job",
@@ -158,6 +193,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getstream": {
+    "name": "GetStream",
+    "description": "Grants permission to get information about a Change Stream",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Stream",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getvpcendpointservicename": {
     "name": "GetVpcEndpointServiceName",
     "description": "Grants permission to retrieve the VPC endpoint service name for a cluster",
@@ -193,6 +243,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "liststreams": {
+    "name": "ListStreams",
+    "description": "Grants permission to retrieve a list of Change Streams for a cluster",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listtagsforresource": {
     "name": "ListTagsForResource",
     "description": "Grants permission to list all tags on an Aurora DSQL resource",
@@ -200,7 +265,13 @@
     "resourceTypes": [
       {
         "name": "Cluster",
-        "required": true,
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Stream",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -347,7 +418,13 @@
     "resourceTypes": [
       {
         "name": "Cluster",
-        "required": true,
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Stream",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -365,7 +442,13 @@
     "resourceTypes": [
       {
         "name": "Cluster",
-        "required": true,
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "Stream",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -391,5 +474,20 @@
       "dsql:WitnessRegion"
     ],
     "dependentActions": []
+  },
+  "updatestream": {
+    "name": "UpdateStream",
+    "description": "Grants permission to modify Change Stream attributes",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Stream",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
   }
 }

package/data/actions/rtbfabric.json

@@ -14,6 +14,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "associatecertificate": {
+    "name": "AssociateCertificate",
+    "description": "Grants permission to associate an ACM certificate with a responder gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ResponderGateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createinboundexternallink": {
     "name": "CreateInboundExternalLink",
     "description": "Grants permission to create an inbound external link for a responder gateway",
@@ -43,6 +58,24 @@
     ],
     "dependentActions": []
   },
+  "createlinkroutingrule": {
+    "name": "CreateLinkRoutingRule",
+    "description": "Grants permission to create a routing rule for a link",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Link",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "createoutboundexternallink": {
     "name": "CreateOutboundExternalLink",
     "description": "Grants permission to create an outbound external link for a requester gateway to connect to external public responder endpoints",
@@ -119,6 +152,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletelinkroutingrule": {
+    "name": "DeleteLinkRoutingRule",
+    "description": "Grants permission to delete a routing rule from a link",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Link",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "LinkRoutingRule",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deleteoutboundexternallink": {
     "name": "DeleteOutboundExternalLink",
     "description": "Grants permission to delete an outbound external link",
@@ -170,6 +224,36 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "disassociatecertificate": {
+    "name": "DisassociateCertificate",
+    "description": "Grants permission to remove a certificate association from a responder gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ResponderGateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcertificateassociation": {
+    "name": "GetCertificateAssociation",
+    "description": "Grants permission to retrieve details of a certificate association with a responder gateway",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ResponderGateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getinboundexternallink": {
     "name": "GetInboundExternalLink",
     "description": "Grants permission to retrieve information about an inbound external link",
@@ -206,6 +290,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getlinkroutingrule": {
+    "name": "GetLinkRoutingRule",
+    "description": "Grants permission to retrieve information about a routing rule for a link",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Link",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "LinkRoutingRule",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getoutboundexternallink": {
     "name": "GetOutboundExternalLink",
     "description": "Grants permission to retrieve information about an outbound external link",
@@ -257,6 +362,36 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listcertificateassociations": {
+    "name": "ListCertificateAssociations",
+    "description": "Grants permission to list certificate associations for a responder gateway",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "ResponderGateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listlinkroutingrules": {
+    "name": "ListLinkRoutingRules",
+    "description": "Grants permission to list routing rules for a link",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "Link",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listlinks": {
     "name": "ListLinks",
     "description": "Grants permission to list links associated with an RTB application",
@@ -298,6 +433,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "LinkRoutingRule",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "OutboundExternalLink",
         "required": false,
@@ -352,6 +493,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "LinkRoutingRule",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "OutboundExternalLink",
         "required": false,
@@ -394,6 +541,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "LinkRoutingRule",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "OutboundExternalLink",
         "required": false,
@@ -448,6 +601,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updatelinkroutingrule": {
+    "name": "UpdateLinkRoutingRule",
+    "description": "Grants permission to update a routing rule for a link",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Link",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "LinkRoutingRule",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updaterequestergateway": {
     "name": "UpdateRequesterGateway",
     "description": "Grants permission to update a requester gateway",

package/data/actions/sagemaker.json

@@ -1,4 +1,20 @@
 {
+  "accessmodelpackage": {
+    "name": "AccessModelPackage",
+    "isPermissionOnly": true,
+    "description": "Grants permission to access model package that can be used in Amazon SageMaker training or hosting services",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "model-package",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "addassociation": {
     "name": "AddAssociation",
     "description": "Grants permission to associate a lineage entity (artifact, context, action, experiment, experiment-trial-component) to each other",

package/data/conditionKeys/rtbfabric.json

@@ -29,6 +29,11 @@
     "description": "Filters access by Link resource linkId identifier",
     "type": "String"
   },
+  "rtbfabric:linkroutingruleruleid": {
+    "key": "rtbfabric:LinkRoutingRuleRuleId",
+    "description": "Filters access by routing rule identifier supporting rule-* formats",
+    "type": "String"
+  },
   "rtbfabric:outboundexternallinklinkid": {
     "key": "rtbfabric:OutboundExternalLinkLinkId",
     "description": "Filters access by OutboundExternalLink resource linkId identifier",

package/data/resourceTypes/bedrock-agentcore.json

@@ -107,7 +107,10 @@
   },
   "policy-engine": {
     "key": "policy-engine",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:policy-engine/${PolicyEngineId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:policy-engine/${PolicyEngineId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "policy": {
     "key": "policy",

package/data/resourceTypes/cloudfront.json

@@ -39,11 +39,17 @@
   },
   "function": {
     "key": "function",
-    "arn": "arn:${Partition}:cloudfront::${Account}:function/${Name}"
+    "arn": "arn:${Partition}:cloudfront::${Account}:function/${Name}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "key-value-store": {
     "key": "key-value-store",
-    "arn": "arn:${Partition}:cloudfront::${Account}:key-value-store/${Name}"
+    "arn": "arn:${Partition}:cloudfront::${Account}:key-value-store/${Name}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "response-headers-policy": {
     "key": "response-headers-policy",

package/data/resourceTypes/dsql.json

@@ -5,5 +5,12 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "stream": {
+    "key": "Stream",
+    "arn": "arn:${Partition}:dsql:${Region}:${Account}:cluster/${ClusterId}/stream/${StreamId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/rtbfabric.json

@@ -18,6 +18,15 @@
       "rtbfabric:ResponderGatewayGatewayId"
     ]
   },
+  "linkroutingrule": {
+    "key": "LinkRoutingRule",
+    "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}/routing-rule/${RuleId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "rtbfabric:LinkLinkId",
+      "rtbfabric:LinkRoutingRuleRuleId"
+    ]
+  },
   "outboundexternallink": {
     "key": "OutboundExternalLink",
     "arn": "arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}",

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.19.202605131",
+  "version": "0.19.202605151",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud-copilot/iam-data.git"
   },
-  "updatedAt": "2026-05-13T05:56:45.336Z",
+  "updatedAt": "2026-05-15T05:58:26.468Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",