@cloud-copilot/iam-data 0.19.202606021 → 0.19.202606051

package/data/actions/securityagent.json

@@ -48,6 +48,40 @@
       "kms:Decrypt"
     ]
   },
+  "batchdeletethreatmodels": {
+    "name": "BatchDeleteThreatModels",
+    "description": "Grants permission to delete multiple threat models in a single request",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "batchdeletethreats": {
+    "name": "BatchDeleteThreats",
+    "description": "Grants permission to delete multiple threats",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "batchgetagentspaces": {
     "name": "BatchGetAgentSpaces",
     "description": "Grants permission to retrieve multiple agent spaces in a single request",
@@ -231,6 +265,74 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "batchgetthreatmodeljobtasks": {
+    "name": "BatchGetThreatModelJobTasks",
+    "description": "Grants permission to retrieve multiple tasks for a threat model job in a single request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "batchgetthreatmodeljobs": {
+    "name": "BatchGetThreatModelJobs",
+    "description": "Grants permission to retrieve details for one or more threat model jobs",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "batchgetthreatmodels": {
+    "name": "BatchGetThreatModels",
+    "description": "Grants permission to retrieve multiple threat models in a single request",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "batchgetthreats": {
+    "name": "BatchGetThreats",
+    "description": "Grants permission to retrieve details for one or more threats",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "createagentspace": {
     "name": "CreateAgentSpace",
     "description": "Grants permission to create an agent space record",
@@ -374,6 +476,40 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createthreat": {
+    "name": "CreateThreat",
+    "description": "Grants permission to create a threat in a threat model",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "createthreatmodel": {
+    "name": "CreateThreatModel",
+    "description": "Grants permission to create a new threat model configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "deleteagentspace": {
     "name": "DeleteAgentSpace",
     "description": "Grants permission to delete an agent space record",
@@ -921,6 +1057,74 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listthreatmodeljobtasks": {
+    "name": "ListThreatModelJobTasks",
+    "description": "Grants permission to list tasks associated with a specific threat model job",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "listthreatmodeljobs": {
+    "name": "ListThreatModelJobs",
+    "description": "Grants permission to list threat model jobs for a threat model",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "listthreatmodels": {
+    "name": "ListThreatModels",
+    "description": "Grants permission to list threat models for an agent space",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "listthreats": {
+    "name": "ListThreats",
+    "description": "Grants permission to list threats for a threat model job with filtering and pagination support",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "putdesignreviewfeedback": {
     "name": "PutDesignReviewFeedback",
     "description": "Grants permission to submit feedback for a design review comment",
@@ -990,6 +1194,24 @@
       "kms:GenerateDataKey"
     ]
   },
+  "startthreatmodeljob": {
+    "name": "StartThreatModelJob",
+    "description": "Grants permission to initiate the execution of a threat model job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt",
+      "kms:GenerateDataKey"
+    ]
+  },
   "stopcodereviewjob": {
     "name": "StopCodeReviewJob",
     "description": "Grants permission to stop the execution of a running code review",
@@ -1024,6 +1246,23 @@
       "kms:Decrypt"
     ]
   },
+  "stopthreatmodeljob": {
+    "name": "StopThreatModelJob",
+    "description": "Grants permission to stop a running threat model job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add tags to a resource",
@@ -1253,6 +1492,40 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updatethreat": {
+    "name": "UpdateThreat",
+    "description": "Grants permission to update a threat",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
+  "updatethreatmodel": {
+    "name": "UpdateThreatModel",
+    "description": "Grants permission to update an existing threat model with new configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "AgentSpace",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "kms:Decrypt"
+    ]
+  },
   "verifytargetdomain": {
     "name": "VerifyTargetDomain",
     "description": "Grants permission to verify ownership for a registered target domain",

package/data/actions/transform.json

@@ -1,4 +1,20 @@
 {
+  "accesstransformprofile": {
+    "name": "AccessTransformProfile",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke AccessTransformProfile on AWS Transform",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "profile",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "associateconnectorresource": {
     "name": "AssociateConnectorResource",
     "isPermissionOnly": true,
@@ -12,7 +28,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "createprofile": {
@@ -53,7 +71,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "deleteprofile": {
@@ -112,7 +132,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getwebappurl": {
@@ -139,7 +161,9 @@
     "description": "Grants permission to invoke ListConnectors on AWS Transform",
     "accessLevel": "List",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "listprofiles": {
@@ -189,7 +213,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "tagresource": {

package/data/conditionKeys/elasticache.json

@@ -49,6 +49,11 @@
     "description": "Filters access by the CacheUsageLimits.DataStorage.Unit parameter in the CreateServerlessCache and ModifyServerlessCache request",
     "type": "String"
   },
+  "elasticache:durability": {
+    "key": "elasticache:Durability",
+    "description": "Filters access by the Durability parameter in the request. Valid values are default, async, sync, or disabled",
+    "type": "String"
+  },
   "elasticache:enginetype": {
     "key": "elasticache:EngineType",
     "description": "Filters access by the engine type present in creation requests. For replication group creations, default engine 'redis' is used as key if parameter is not present",

package/data/conditionKeys/finops-agent.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/iot.json

@@ -46,8 +46,8 @@
   },
   "iot:includesocketinformation": {
     "key": "iot:IncludeSocketInformation",
-    "description": "Filters access by GetConnection includeSocketInformation request parameter",
-    "type": "String"
+    "description": "Filters access by GetConnection and GetThingConnectivityData includeSocketInformation request parameter",
+    "type": "Bool"
   },
   "iot:thinggrouparn": {
     "key": "iot:ThingGroupArn",

package/data/conditionKeys/sagemaker.json

@@ -24,6 +24,11 @@
     "description": "Filters access by the app network access type associated with the resource in the request",
     "type": "String"
   },
+  "sagemaker:bearertokentype": {
+    "key": "sagemaker:BearerTokenType",
+    "description": "Filters access by the type of bearer token used in the request",
+    "type": "String"
+  },
   "sagemaker:currentcustomermetadataproperties/${metadatakey}": {
     "key": "sagemaker:CurrentCustomerMetadataProperties/${MetadataKey}",
     "description": "Filters access by a current metadata key and value pair associated with the model-package resource",
@@ -66,7 +71,12 @@
   },
   "sagemaker:domainsharingoutputkmskey": {
     "key": "sagemaker:DomainSharingOutputKmsKey",
-    "description": "Filters access by the Domain sharing output KMS key associated with the resource in the request",
+    "description": "Filters access by the Domain sharing output KMS key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:DomainSharingOutputKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:domainsharingoutputkmskeyarn": {
+    "key": "sagemaker:DomainSharingOutputKmsKeyArn",
+    "description": "Filters access by the Domain sharing output KMS key associated with the resource in the request. The ARN of the key-id must be used",
     "type": "ARN"
   },
   "sagemaker:enableremotedebug": {
@@ -91,7 +101,12 @@
   },
   "sagemaker:featuregroupofflinestorekmskey": {
     "key": "sagemaker:FeatureGroupOfflineStoreKmsKey",
-    "description": "Filters access by the offline store kms key associated with the feature group resource in the request",
+    "description": "Filters access by the offline store kms key associated with the feature group resource in the request. This key has been deprecated. It has been replaced by sagemaker:FeatureGroupOfflineStoreKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:featuregroupofflinestorekmskeyarn": {
+    "key": "sagemaker:FeatureGroupOfflineStoreKmsKeyArn",
+    "description": "Filters access by the offline store kms key associated with the feature group resource in the request. The ARN of the key-id must be used",
     "type": "ARN"
   },
   "sagemaker:featuregroupofflinestores3uri": {
@@ -101,7 +116,12 @@
   },
   "sagemaker:featuregrouponlinestorekmskey": {
     "key": "sagemaker:FeatureGroupOnlineStoreKmsKey",
-    "description": "Filters access by the online store kms key associated with the feature group resource in the request",
+    "description": "Filters access by the online store kms key associated with the feature group resource in the request. This key has been deprecated. It has been replaced by sagemaker:FeatureGroupOnlineStoreKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:featuregrouponlinestorekmskeyarn": {
+    "key": "sagemaker:FeatureGroupOnlineStoreKmsKeyArn",
+    "description": "Filters access by the online store kms key associated with the feature group resource in the request. The ARN of the key-id must be used",
     "type": "ARN"
   },
   "sagemaker:filesystemaccessmode": {
@@ -126,7 +146,7 @@
   },
   "sagemaker:homeefsfilesystemkmskey": {
     "key": "sagemaker:HomeEfsFileSystemKmsKey",
-    "description": "Filters access by a key that is present in the request the user makes to the SageMaker service. This key is deprecated. It has been replaced by sagemaker:VolumeKmsKey",
+    "description": "Filters access by a key that is present in the request the user makes to the SageMaker service. This key has been deprecated. It has been replaced by sagemaker:VolumeKmsKeyArn",
     "type": "ARN"
   },
   "sagemaker:imagearns": {
@@ -196,7 +216,12 @@
   },
   "sagemaker:outputkmskey": {
     "key": "sagemaker:OutputKmsKey",
-    "description": "Filters access by the output kms key associated with the resource in the request",
+    "description": "Filters access by the output kms key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:OutputKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:outputkmskeyarn": {
+    "key": "sagemaker:OutputKmsKeyArn",
+    "description": "Filters access by the output kms key associated with the resource in the request. The ARN of the key-id must be used",
     "type": "ARN"
   },
   "sagemaker:owneruserprofilearn": {
@@ -271,7 +296,12 @@
   },
   "sagemaker:volumekmskey": {
     "key": "sagemaker:VolumeKmsKey",
-    "description": "Filters access by the volume kms key associated with the resource in the request",
+    "description": "Filters access by the volume kms key associated with the resource in the request. This key has been deprecated. It has been replaced by sagemaker:VolumeKmsKeyArn",
+    "type": "ARN"
+  },
+  "sagemaker:volumekmskeyarn": {
+    "key": "sagemaker:VolumeKmsKeyArn",
+    "description": "Filters access by the volume kms key associated with the resource in the request. The ARN of the key-id must be used",
     "type": "ARN"
   },
   "sagemaker:vpcsecuritygroupids": {

package/data/conditionKeys/transform.json

@@ -4,6 +4,11 @@
     "description": "Filters access by the tags that are passed in the request",
     "type": "String"
   },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
   "aws:tagkeys": {
     "key": "aws:TagKeys",
     "description": "Filters access by the tag keys that are passed in the request",

package/data/resourceTypes/elasticache.json

@@ -40,6 +40,7 @@
       "elasticache:CacheNodeType",
       "elasticache:CacheParameterGroupName",
       "elasticache:ClusterModeEnabled",
+      "elasticache:Durability",
       "elasticache:EngineType",
       "elasticache:EngineVersion",
       "elasticache:KmsKeyId",

package/data/resourceTypes/finops-agent.json

@@ -0,0 +1 @@
+{}

package/data/resourceTypes/glue.json

@@ -19,11 +19,17 @@
   },
   "table": {
     "key": "table",
-    "arn": "arn:${Partition}:glue:${Region}:${Account}:table/${DatabaseName}/${TableName}"
+    "arn": "arn:${Partition}:glue:${Region}:${Account}:table/${DatabaseName}/${TableName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "tableversion": {
     "key": "tableversion",
-    "arn": "arn:${Partition}:glue:${Region}:${Account}:tableVersion/${DatabaseName}/${TableName}/${TableVersionName}"
+    "arn": "arn:${Partition}:glue:${Region}:${Account}:tableVersion/${DatabaseName}/${TableName}/${TableVersionName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "connection": {
     "key": "connection",
@@ -34,7 +40,10 @@
   },
   "userdefinedfunction": {
     "key": "userdefinedfunction",
-    "arn": "arn:${Partition}:glue:${Region}:${Account}:userDefinedFunction/${DatabaseName}/${UserDefinedFunctionName}"
+    "arn": "arn:${Partition}:glue:${Region}:${Account}:userDefinedFunction/${DatabaseName}/${UserDefinedFunctionName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "devendpoint": {
     "key": "devendpoint",

package/data/resourceTypes/quicksight.json

@@ -5,7 +5,10 @@
   },
   "user": {
     "key": "user",
-    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:user/${ResourceId}"
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:user/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "group": {
     "key": "group",
@@ -39,6 +42,13 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "oauthclientapplication": {
+    "key": "oauthClientApplication",
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:oauthClientApplication/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "assetbundleexportjob": {
     "key": "assetBundleExportJob",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:asset-bundle-export-job/${ResourceId}"
@@ -92,7 +102,10 @@
   },
   "namespace": {
     "key": "namespace",
-    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:namespace/${ResourceId}"
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:namespace/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "folder": {
     "key": "folder",
@@ -170,8 +183,19 @@
     "key": "automationGroup",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:automation-group/${ResourceId}"
   },
+  "knowledgebase": {
+    "key": "knowledgeBase",
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:knowledge-base/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "space": {
     "key": "space",
     "arn": "arn:${Partition}:quicksight:${Region}:${Account}:space/${ResourceId}"
+  },
+  "approvalpolicy": {
+    "key": "approvalPolicy",
+    "arn": "arn:${Partition}:quicksight:${Region}:${Account}:approval-policy/${ResourceId}"
   }
 }

package/data/resourceTypes/sagemaker.json

@@ -227,6 +227,14 @@
       "sagemaker:ResourceTag/${TagKey}"
     ]
   },
+  "job": {
+    "key": "job",
+    "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:job/${JobCategory}/${JobName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "sagemaker:ResourceTag/${TagKey}"
+    ]
+  },
   "hyper-parameter-tuning-job": {
     "key": "hyper-parameter-tuning-job",
     "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:hyper-parameter-tuning-job/${HyperParameterTuningJobName}",

package/data/resourceTypes/transform.json

@@ -5,6 +5,9 @@
   },
   "connector": {
     "key": "connector",
-    "arn": "arn:${Partition}:transform:${Region}:${Account}:connector/${WorkspaceId}/${ConnectorId}"
+    "arn": "arn:${Partition}:transform:${Region}:${Account}:connector/${WorkspaceId}/${ConnectorId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/serviceNames.json

@@ -167,6 +167,7 @@
   "evidently": "Amazon CloudWatch Evidently",
   "evs": "Amazon Elastic VMware Service",
   "execute-api": "Amazon API Gateway",
+  "finops-agent": "AWS FinOps Agent",
   "finspace": "Amazon FinSpace",
   "finspace-api": "Amazon FinSpace API",
   "firehose": "Amazon Kinesis Firehose",

package/data/services.json

@@ -167,6 +167,7 @@
   "evidently",
   "evs",
   "execute-api",
+  "finops-agent",
   "finspace",
   "finspace-api",
   "firehose",