@cloud-copilot/iam-data 0.19.202606171 → 0.19.202606201

package/data/actions/cloudwatch.json

@@ -70,7 +70,11 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": []
+    "dependentActions": [
+      "logs:CreateScheduledQuery",
+      "logs:DeleteScheduledQuery",
+      "logs:GetScheduledQuery"
+    ]
   },
   "deleteanomalydetector": {
     "name": "DeleteAnomalyDetector",
@@ -308,6 +312,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdataset": {
+    "name": "GetDataset",
+    "description": "Grants permission to get a dataset",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "getinsightrulereport": {
     "name": "GetInsightRuleReport",
     "description": "Grants permission to return the top-N report of unique contributors over a time range for a given insight rule",
@@ -325,10 +346,19 @@
   },
   "getmetricdata": {
     "name": "GetMetricData",
-    "description": "Grants permission to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data",
+    "description": "Grants permission to retrieve batch amounts of CloudWatch classic metric data and perform metric math on retrieved data; and grants permission to retrieve OTLP metric data using PromQL",
     "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "getmetricstatistics": {
@@ -499,8 +529,17 @@
     "name": "ListMetrics",
     "description": "Grants permission to retrieve a list of valid metrics stored for the AWS account owner",
     "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ],
     "dependentActions": []
   },
   "listservicelevelobjectives": {
@@ -527,31 +566,65 @@
       {
         "name": "alarm",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "alarm-mute-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "dashboard",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "insight-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "metric-stream",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "service",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "slo",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -585,6 +658,15 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-Dataset",
+        "resourceTypes": [
+          {
+            "name": "dataset",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-InsightRule",
         "resourceTypes": [
@@ -594,6 +676,24 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-MetricStream",
+        "resourceTypes": [
+          {
+            "name": "metric-stream",
+            "required": true
+          }
+        ]
+      },
+      {
+        "name": "CloudWatch-Service",
+        "resourceTypes": [
+          {
+            "name": "service",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-ServiceLevelObjective",
         "resourceTypes": [
@@ -693,6 +793,31 @@
     ],
     "dependentActions": []
   },
+  "putlogalarm": {
+    "name": "PutLogAlarm",
+    "description": "Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "alarm",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "iam:PassRole",
+          "logs:CreateScheduledQuery",
+          "logs:DeleteScheduledQuery",
+          "logs:GetScheduledQuery",
+          "logs:UpdateScheduledQuery"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "cloudwatch:AlarmActions"
+    ],
+    "dependentActions": []
+  },
   "putmanagedinsightrules": {
     "name": "PutManagedInsightRules",
     "description": "Grants permission to create managed Insight Rules",
@@ -715,6 +840,14 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -726,9 +859,18 @@
   },
   "putmetricdata": {
     "name": "PutMetricData",
-    "description": "Grants permission to publish metric data points to Amazon CloudWatch",
+    "description": "Grants permission to publish metric data points to Amazon CloudWatch using CloudWatch and OTLP formats",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [
       "cloudwatch:namespace"
     ],
@@ -823,31 +965,65 @@
       {
         "name": "alarm",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "alarm-mute-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "dashboard",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "insight-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "metric-stream",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "service",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "slo",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -884,6 +1060,15 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-Dataset",
+        "resourceTypes": [
+          {
+            "name": "dataset",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-InsightRule",
         "resourceTypes": [
@@ -893,6 +1078,24 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-MetricStream",
+        "resourceTypes": [
+          {
+            "name": "metric-stream",
+            "required": true
+          }
+        ]
+      },
+      {
+        "name": "CloudWatch-Service",
+        "resourceTypes": [
+          {
+            "name": "service",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-ServiceLevelObjective",
         "resourceTypes": [
@@ -912,31 +1115,65 @@
       {
         "name": "alarm",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "alarm-mute-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "dashboard",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "dataset",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "insight-rule",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "metric-stream",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "service",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "slo",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -972,6 +1209,15 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-Dataset",
+        "resourceTypes": [
+          {
+            "name": "dataset",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-InsightRule",
         "resourceTypes": [
@@ -981,6 +1227,24 @@
           }
         ]
       },
+      {
+        "name": "CloudWatch-MetricStream",
+        "resourceTypes": [
+          {
+            "name": "metric-stream",
+            "required": true
+          }
+        ]
+      },
+      {
+        "name": "CloudWatch-Service",
+        "resourceTypes": [
+          {
+            "name": "service",
+            "required": true
+          }
+        ]
+      },
       {
         "name": "CloudWatch-ServiceLevelObjective",
         "resourceTypes": [

package/data/actions/connect.json

@@ -5876,14 +5876,7 @@
     "name": "StartOutboundVoiceContact",
     "description": "Grants permission to initiate outbound calls using the Amazon Connect API",
     "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "contact",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },

package/data/actions/datazone.json

@@ -562,6 +562,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletelineageevent": {
+    "name": "DeleteLineageEvent",
+    "description": "Grants permission to delete lineage events",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletelisting": {
     "name": "DeleteListing",
     "description": "Grants permission to delete listing",
@@ -722,6 +730,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getcompute": {
+    "name": "GetCompute",
+    "description": "Grants permission to get compute",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getconnection": {
     "name": "GetConnection",
     "description": "Grants permission to get connections",
@@ -1612,6 +1628,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "startcompute": {
+    "name": "StartCompute",
+    "description": "Grants permission to start compute",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "startconversation": {
     "name": "StartConversation",
     "description": "Grants permission to start conversations",
@@ -1660,6 +1684,22 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "startnotebooksync": {
+    "name": "StartNotebookSync",
+    "description": "Grants permission to start notebook sync",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopcompute": {
+    "name": "StopCompute",
+    "description": "Grants permission to stop compute",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "stopmetadatagenerationrun": {
     "name": "StopMetadataGenerationRun",
     "description": "Grants permission to stop metadata generation run",

package/data/actions/ecs.json

@@ -1528,6 +1528,7 @@
       "ecs:propagate-tags",
       "ecs:subnet",
       "ecs:task-cpu",
+      "ecs:task-definition",
       "ecs:task-memory"
     ],
     "dependentActions": []

package/data/actions/eks.json

@@ -157,7 +157,8 @@
       "eks:deletionProtection",
       "eks:controlPlaneScalingTier",
       "eks:encryptionConfigProviderKeyArns",
-      "eks:zonalShiftEnabled"
+      "eks:zonalShiftEnabled",
+      "eks:controlPlaneEgressMode"
     ],
     "dependentActions": []
   },
@@ -1163,7 +1164,8 @@
       "eks:endpointPrivateAccess",
       "eks:deletionProtection",
       "eks:controlPlaneScalingTier",
-      "eks:zonalShiftEnabled"
+      "eks:zonalShiftEnabled",
+      "eks:controlPlaneEgressMode"
     ],
     "dependentActions": []
   },

package/data/actions/es.json

@@ -108,6 +108,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "attachdatasource": {
+    "name": "AttachDataSource",
+    "description": "Grants permission to attach a data source to an OpenSearch Application",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "authorizevpcendpointaccess": {
     "name": "AuthorizeVpcEndpointAccess",
     "description": "Grants permission to provide access to an Amazon OpenSearch Service domain through the use of an interface VPC endpoint",
@@ -446,6 +461,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describedatasourceattachment": {
+    "name": "DescribeDataSourceAttachment",
+    "description": "Grants permission to describe the status of a data source attachment for an OpenSearch Application",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describedomain": {
     "name": "DescribeDomain",
     "description": "Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN",
@@ -722,6 +752,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "detachdatasource": {
+    "name": "DetachDataSource",
+    "description": "Grants permission to detach a data source from an OpenSearch Application",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "dissociatepackage": {
     "name": "DissociatePackage",
     "description": "Grants permission to disassociate a package from the specified OpenSearch Service domain",
@@ -1045,6 +1090,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdatasourceattachments": {
+    "name": "ListDataSourceAttachments",
+    "description": "Grants permission to list data source attachments for an OpenSearch Application",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "application",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listdatasources": {
     "name": "ListDataSources",
     "description": "Grants permission to retrieve a list of data source for the OpenSearch Service domain",

package/data/actions/mq.json

@@ -225,6 +225,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describesharedresources": {
+    "name": "DescribeSharedResources",
+    "description": "Grants permission to return the resources shared to a broker",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "brokers",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describeuser": {
     "name": "DescribeUser",
     "description": "Grants permission to return information about an ActiveMQ user",