@cloud-copilot/iam-data 0.19.202606171 → 0.19.202606181

package/data/actions/bedrock-agentcore.json

@@ -345,10 +345,32 @@
     ],
     "dependentActions": [
       "bedrock-agentcore:CreateAgentRuntime",
+      "bedrock-agentcore:CreateMemory",
       "bedrock-agentcore:GetAgentRuntime",
+      "bedrock-agentcore:GetMemory",
       "iam:PassRole"
     ]
   },
+  "createharnessendpoint": {
+    "name": "CreateHarnessEndpoint",
+    "description": "Grants permission to create a new harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "bedrock-agentcore:CreateAgentRuntimeEndpoint"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "creatememory": {
     "name": "CreateMemory",
     "description": "Grants permission to create a Memory resource",
@@ -796,10 +818,35 @@
     "conditionKeys": [],
     "dependentActions": [
       "bedrock-agentcore:DeleteAgentRuntime",
+      "bedrock-agentcore:DeleteMemory",
       "bedrock-agentcore:GetAgentRuntime",
+      "bedrock-agentcore:GetMemory",
       "iam:PassRole"
     ]
   },
+  "deleteharnessendpoint": {
+    "name": "DeleteHarnessEndpoint",
+    "description": "Grants permission to delete a harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "bedrock-agentcore:DeleteAgentRuntimeEndpoint"
+        ]
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletememory": {
     "name": "DeleteMemory",
     "description": "Grants permission to delete a Memory resource",
@@ -1091,6 +1138,63 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "gatewayassociatewebacl": {
+    "name": "GatewayAssociateWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to associate an AWS WAF Web ACL with an AgentCore Gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaydisassociatewebacl": {
+    "name": "GatewayDisassociateWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to remove the AWS WAF Web ACL association from an AgentCore Gateway",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaygetwebaclforresource": {
+    "name": "GatewayGetWebACLForResource",
+    "isPermissionOnly": true,
+    "description": "Grants permission to retrieve the AWS WAF Web ACL ARN currently associated with an AgentCore Gateway",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "gateway",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gatewaylistresourcesforwebacl": {
+    "name": "GatewayListResourcesForWebACL",
+    "isPermissionOnly": true,
+    "description": "Grants permission to list AgentCore Gateways associated with an AWS WAF Web ACL",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getabtest": {
     "name": "GetABTest",
     "description": "Grants permission to get details of an A/B test",
@@ -1409,6 +1513,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getharnessendpoint": {
+    "name": "GetHarnessEndpoint",
+    "description": "Grants permission to get details of a harness endpoint",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getmemory": {
     "name": "GetMemory",
     "description": "Grants permission to fetch details for a Memory resource",
@@ -2135,13 +2260,19 @@
         "name": "harness",
         "required": true,
         "conditionKeys": [],
+        "dependentActions": [
+          "bedrock-agentcore:InvokeAgentRuntime"
+        ]
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "bedrock-agentcore:InvokeAgentRuntime"
-    ]
+    "dependentActions": []
   },
   "invokeregistrymcp": {
     "name": "InvokeRegistryMcp",
@@ -2158,6 +2289,22 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "invokewebsearch": {
+    "name": "InvokeWebSearch",
+    "isPermissionOnly": true,
+    "description": "Grants permission to invoke a web search target",
+    "accessLevel": "Permissions management",
+    "resourceTypes": [
+      {
+        "name": "web-search",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listabtests": {
     "name": "ListABTests",
     "description": "Grants permission to list A/B tests",
@@ -2374,6 +2521,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listharnessendpoints": {
+    "name": "ListHarnessEndpoints",
+    "description": "Grants permission to list harness endpoints",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listharnesses": {
     "name": "ListHarnesses",
     "description": "Grants permission to list harnesses",
@@ -3611,11 +3766,37 @@
     ],
     "conditionKeys": [],
     "dependentActions": [
+      "bedrock-agentcore:CreateMemory",
       "bedrock-agentcore:GetAgentRuntime",
+      "bedrock-agentcore:GetMemory",
       "bedrock-agentcore:UpdateAgentRuntime",
+      "bedrock-agentcore:UpdateMemory",
       "iam:PassRole"
     ]
   },
+  "updateharnessendpoint": {
+    "name": "UpdateHarnessEndpoint",
+    "description": "Grants permission to update harness endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "harness",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "bedrock-agentcore:UpdateAgentRuntimeEndpoint"
+        ]
+      },
+      {
+        "name": "harness-endpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updatememory": {
     "name": "UpdateMemory",
     "description": "Grants permission to update a Memory resource",

package/data/actions/bedrock.json

@@ -1,4 +1,12 @@
 {
+  "agenticretrievestream": {
+    "name": "AgenticRetrieveStream",
+    "description": "Grants permission to perform agentic retrieve with streaming from retrievers",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "allowvendedlogdeliveryforresource": {
     "name": "AllowVendedLogDeliveryForResource",
     "isPermissionOnly": true,
@@ -83,6 +91,21 @@
     ],
     "dependentActions": []
   },
+  "batchdeleteadvancedpromptoptimizationjob": {
+    "name": "BatchDeleteAdvancedPromptOptimizationJob",
+    "description": "Grants permission to delete one or more advanced prompt optimization jobs",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "batchdeleteevaluationjob": {
     "name": "BatchDeleteEvaluationJob",
     "description": "Grants permission to batch delete list of bedrock evaluation jobs",
@@ -153,6 +176,17 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createadvancedpromptoptimizationjob": {
+    "name": "CreateAdvancedPromptOptimizationJob",
+    "description": "Grants permission to create an advanced prompt optimization job",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "createagent": {
     "name": "CreateAgent",
     "description": "Grants permission to create a new agent and a test agent alias pointing to the DRAFT agent version",
@@ -1204,6 +1238,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "knowledge-base",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -1342,6 +1382,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getadvancedpromptoptimizationjob": {
+    "name": "GetAdvancedPromptOptimizationJob",
+    "description": "Grants permission to get information about an advanced prompt optimization job",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getagent": {
     "name": "GetAgent",
     "description": "Grants permission to retrieve an existing agent",
@@ -1744,6 +1799,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdocumentcontent": {
+    "name": "GetDocumentContent",
+    "description": "Grants permission to retrieve a document",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getevaluationjob": {
     "name": "GetEvaluationJob",
     "description": "Grants permission to get the properties associated with a evaluation job. Use this operation to get the status of a evaluation job",
@@ -2170,6 +2233,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "knowledge-base",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -2389,6 +2458,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "invokeguardrailchecks": {
+    "name": "InvokeGuardrailChecks",
+    "description": "Grants permission to invoke guardrail checks",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "invokeinlineagent": {
     "name": "InvokeInlineAgent",
     "description": "Grants permission to send user input (text-only) to the inline agent for Bedrock",
@@ -2570,6 +2647,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listadvancedpromptoptimizationjobs": {
+    "name": "ListAdvancedPromptOptimizationJobs",
+    "description": "Grants permission to list the advanced prompt optimization jobs in your account",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listagentactiongroups": {
     "name": "ListAgentActionGroups",
     "description": "Grants permission to list action groups in an agent",
@@ -3142,6 +3227,12 @@
     "description": "Grants permission to list tags for a Bedrock resource",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "agent",
         "required": true,
@@ -3436,6 +3527,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "knowledge-base",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -3586,6 +3683,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "stopadvancedpromptoptimizationjob": {
+    "name": "StopAdvancedPromptOptimizationJob",
+    "description": "Grants permission to stop an advanced prompt optimization job while in progress",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "stopevaluationjob": {
     "name": "StopEvaluationJob",
     "description": "Grants permission to stop a evaluation job while in progress",
@@ -3678,6 +3790,12 @@
     "description": "Grants permission to Tag a Bedrock resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "agent",
         "required": false,
@@ -3870,6 +3988,12 @@
     "description": "Grants permission to Untag a Bedrock resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "advanced-prompt-optimization-job",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "agent",
         "required": false,

package/data/actions/connect.json

@@ -5876,14 +5876,7 @@
     "name": "StartOutboundVoiceContact",
     "description": "Grants permission to initiate outbound calls using the Amazon Connect API",
     "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "contact",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },

package/data/actions/datazone.json

@@ -562,6 +562,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletelineageevent": {
+    "name": "DeleteLineageEvent",
+    "description": "Grants permission to delete lineage events",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletelisting": {
     "name": "DeleteListing",
     "description": "Grants permission to delete listing",

package/data/actions/es.json

@@ -108,6 +108,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "attachdatasource": {
+    "name": "AttachDataSource",
+    "description": "Grants permission to attach a data source to an OpenSearch Application",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "authorizevpcendpointaccess": {
     "name": "AuthorizeVpcEndpointAccess",
     "description": "Grants permission to provide access to an Amazon OpenSearch Service domain through the use of an interface VPC endpoint",
@@ -446,6 +461,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describedatasourceattachment": {
+    "name": "DescribeDataSourceAttachment",
+    "description": "Grants permission to describe the status of a data source attachment for an OpenSearch Application",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describedomain": {
     "name": "DescribeDomain",
     "description": "Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN",
@@ -722,6 +752,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "detachdatasource": {
+    "name": "DetachDataSource",
+    "description": "Grants permission to detach a data source from an OpenSearch Application",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "dissociatepackage": {
     "name": "DissociatePackage",
     "description": "Grants permission to disassociate a package from the specified OpenSearch Service domain",
@@ -1045,6 +1090,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdatasourceattachments": {
+    "name": "ListDataSourceAttachments",
+    "description": "Grants permission to list data source attachments for an OpenSearch Application",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listdatasources": {
     "name": "ListDataSources",
     "description": "Grants permission to retrieve a list of data source for the OpenSearch Service domain",

package/data/actions/s3.json

@@ -736,6 +736,36 @@
     ],
     "dependentActions": []
   },
+  "deleteobjectannotation": {
+    "name": "DeleteObjectAnnotation",
+    "description": "Grants permission to delete an annotation from an object",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:x-amz-object-if-match",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "deleteobjecttagging": {
     "name": "DeleteObjectTagging",
     "description": "Grants permission to use the tagging subresource to remove the entire tag set from the specified object",
@@ -795,6 +825,37 @@
     ],
     "dependentActions": []
   },
+  "deleteobjectversionannotation": {
+    "name": "DeleteObjectVersionAnnotation",
+    "description": "Grants permission to delete an annotation from a specific version of an object",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:versionid",
+      "s3:x-amz-object-if-match",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "deleteobjectversiontagging": {
     "name": "DeleteObjectVersionTagging",
     "description": "Grants permission to remove the entire tag set for a specific version of the object",
@@ -2000,6 +2061,35 @@
     ],
     "dependentActions": []
   },
+  "getobjectannotation": {
+    "name": "GetObjectAnnotation",
+    "description": "Grants permission to retrieve an annotation from an object",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "getobjectattributes": {
     "name": "GetObjectAttributes",
     "description": "Grants permission to retrieve attributes related to a specific object",
@@ -2198,6 +2288,58 @@
     ],
     "dependentActions": []
   },
+  "getobjectversionannotation": {
+    "name": "GetObjectVersionAnnotation",
+    "description": "Grants permission to retrieve an annotation from a specific version of an object",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:versionid",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
+  "getobjectversionannotationforreplication": {
+    "name": "GetObjectVersionAnnotationForReplication",
+    "description": "Grants permission to get an object version annotation for replication",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "object",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "getobjectversionattributes": {
     "name": "GetObjectVersionAttributes",
     "description": "Grants permission to retrieve attributes related to a specific version of an object",
@@ -2710,6 +2852,69 @@
     ],
     "dependentActions": []
   },
+  "listobjectannotations": {
+    "name": "ListObjectAnnotations",
+    "description": "Grants permission to list annotations on an object",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:annotation-prefix",
+      "s3:max-annotation-results",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
+  "listobjectversionannotations": {
+    "name": "ListObjectVersionAnnotations",
+    "description": "Grants permission to list annotations on a specific version of an object",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:versionid",
+      "s3:annotation-prefix",
+      "s3:max-annotation-results",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "liststoragelensconfigurations": {
     "name": "ListStorageLensConfigurations",
     "description": "Grants permission to list Amazon S3 Storage Lens configurations",
@@ -3491,6 +3696,7 @@
       "s3:x-amz-grant-write",
       "s3:x-amz-grant-write-acp",
       "s3:x-amz-metadata-directive",
+      "s3:x-amz-object-annotation-directive",
       "s3:x-amz-server-side-encryption",
       "s3:x-amz-server-side-encryption-aws-kms-key-id",
       "s3:x-amz-server-side-encryption-customer-algorithm",
@@ -3543,6 +3749,36 @@
     ],
     "dependentActions": []
   },
+  "putobjectannotation": {
+    "name": "PutObjectAnnotation",
+    "description": "Grants permission to add or replace an annotation on an object",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:x-amz-object-if-match",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "putobjectlegalhold": {
     "name": "PutObjectLegalHold",
     "description": "Grants permission to apply a Legal Hold configuration to the specified object",
@@ -3672,6 +3908,37 @@
     ],
     "dependentActions": []
   },
+  "putobjectversionannotation": {
+    "name": "PutObjectVersionAnnotation",
+    "description": "Grants permission to add or replace an annotation on a specific version of an object",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "object",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256",
+      "s3:ResourceAccount",
+      "s3:versionid",
+      "s3:x-amz-object-if-match",
+      "s3:ExistingObjectTag/<key>"
+    ],
+    "dependentActions": []
+  },
   "putobjectversiontagging": {
     "name": "PutObjectVersionTagging",
     "description": "Grants permission to set the supplied tag-set for a specific version of an object",
@@ -3817,6 +4084,28 @@
     ],
     "dependentActions": []
   },
+  "replicateobjectannotation": {
+    "name": "ReplicateObjectAnnotation",
+    "description": "Grants permission to replicate annotations to the destination bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "object",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "replicatetags": {
     "name": "ReplicateTags",
     "description": "Grants permission to replicate object tags to the destination bucket",
@@ -4022,6 +4311,28 @@
     ],
     "dependentActions": []
   },
+  "updatebucketmetadataannotationtableconfiguration": {
+    "name": "UpdateBucketMetadataAnnotationTableConfiguration",
+    "description": "Grants permission to update the annotation table configuration for a bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "updatebucketmetadatainventorytableconfiguration": {
     "name": "UpdateBucketMetadataInventoryTableConfiguration",
     "description": "Grants permission to update the inventory table configuration on an existing S3 Metadata configuration for a specified general purpose bucket",

package/data/conditionKeys/s3.json

@@ -114,6 +114,11 @@
     "description": "Filters access by the TLS version used by the client",
     "type": "Numeric"
   },
+  "s3:annotation-prefix": {
+    "key": "s3:annotation-prefix",
+    "description": "Filters access by the annotation name prefix specified in the request",
+    "type": "String"
+  },
   "s3:authtype": {
     "key": "s3:authType",
     "description": "Filters access by authentication method",
@@ -159,6 +164,11 @@
     "description": "Filters access by specific log type, currently supports S3_SERVER_ACCESS_LOGS",
     "type": "String"
   },
+  "s3:max-annotation-results": {
+    "key": "s3:max-annotation-results",
+    "description": "Filters access by the maximum number of annotation results requested",
+    "type": "Numeric"
+  },
   "s3:max-keys": {
     "key": "s3:max-keys",
     "description": "Filters access by maximum number of keys returned in a ListBucket request",
@@ -259,6 +269,16 @@
     "description": "Filters access by object metadata behavior (COPY or REPLACE) when objects are copied",
     "type": "String"
   },
+  "s3:x-amz-object-annotation-directive": {
+    "key": "s3:x-amz-object-annotation-directive",
+    "description": "Filters access by the annotation copy directive specified in the request",
+    "type": "String"
+  },
+  "s3:x-amz-object-if-match": {
+    "key": "s3:x-amz-object-if-match",
+    "description": "Filters access by the ETag of the object version specified in the request",
+    "type": "String"
+  },
   "s3:x-amz-object-ownership": {
     "key": "s3:x-amz-object-ownership",
     "description": "Filters access by Object Ownership",

package/data/resourceTypes/bedrock-agentcore.json

@@ -135,21 +135,40 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "harness-endpoint": {
+    "key": "harness-endpoint",
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:harness/${HarnessId}/harness-endpoint/${Name}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "batch-evaluate": {
     "key": "batch-evaluate",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:batch-evaluate/${BatchEvaluationId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:batch-evaluate/${BatchEvaluationId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "ab-test": {
     "key": "ab-test",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:ab-test/${ABTestId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:ab-test/${ABTestId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "recommendation": {
     "key": "recommendation",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:recommendation/${RecommendationId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:recommendation/${RecommendationId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "configuration-bundle": {
     "key": "configuration-bundle",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:configuration-bundle/${ConfigurationBundleId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:configuration-bundle/${ConfigurationBundleId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "payment-manager": {
     "key": "payment-manager",
@@ -164,5 +183,9 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "web-search": {
+    "key": "web-search",
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:tool/web-search.v1"
   }
 }

package/data/resourceTypes/bedrock.json

@@ -240,5 +240,12 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "advanced-prompt-optimization-job": {
+    "key": "advanced-prompt-optimization-job",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:advanced-prompt-optimization-job/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/inspector2.json

@@ -30,12 +30,5 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
-  },
-  "connector": {
-    "key": "Connector",
-    "arn": "arn:${Partition}:inspector2:${Region}:${Account}:connector/${ConnectorId}",
-    "conditionKeys": [
-      "aws:ResourceTag/${TagKey}"
-    ]
   }
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.19.202606171",
+  "version": "0.19.202606181",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud-copilot/iam-data.git"
   },
-  "updatedAt": "2026-06-17T06:26:03.140Z",
+  "updatedAt": "2026-06-18T06:16:01.826Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",