@cloud-copilot/iam-data 0.19.202607021 → 0.19.202607151

package/data/actions/securitylake.json

@@ -12,15 +12,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "glue:CreateDatabase",
-      "glue:CreateTable",
-      "glue:GetDatabase",
-      "glue:GetTable",
-      "iam:CreateServiceLinkedRole",
-      "kms:CreateGrant",
-      "kms:DescribeKey"
-    ]
+    "dependentActions": []
   },
   "createcustomlogsource": {
     "name": "CreateCustomLogSource",
@@ -35,23 +27,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "glue:CreateCrawler",
-      "glue:CreateDatabase",
-      "glue:CreateTable",
-      "glue:StartCrawlerSchedule",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:PassRole",
-      "iam:PutRolePolicy",
-      "kms:CreateGrant",
-      "kms:DescribeKey",
-      "kms:GenerateDataKey",
-      "lakeformation:GrantPermissions",
-      "lakeformation:RegisterResource",
-      "s3:ListBucket",
-      "s3:PutObject"
-    ]
+    "dependentActions": []
   },
   "createdatalake": {
     "name": "CreateDataLake",
@@ -62,36 +38,7 @@
         "name": "data-lake",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "events:PutRule",
-          "events:PutTargets",
-          "iam:CreateServiceLinkedRole",
-          "iam:DeleteRolePolicy",
-          "iam:GetRole",
-          "iam:ListAttachedRolePolicies",
-          "iam:PassRole",
-          "iam:PutRolePolicy",
-          "kms:CreateGrant",
-          "kms:DescribeKey",
-          "lakeformation:GetDataLakeSettings",
-          "lakeformation:PutDataLakeSettings",
-          "lambda:AddPermission",
-          "lambda:CreateEventSourceMapping",
-          "lambda:CreateFunction",
-          "organizations:DescribeOrganization",
-          "organizations:ListAccounts",
-          "organizations:ListDelegatedServicesForAccount",
-          "s3:CreateBucket",
-          "s3:GetObject",
-          "s3:GetObjectVersion",
-          "s3:ListBucket",
-          "s3:PutBucketPolicy",
-          "s3:PutBucketPublicAccessBlock",
-          "s3:PutBucketVersioning",
-          "sqs:CreateQueue",
-          "sqs:GetQueueAttributes",
-          "sqs:SetQueueAttributes"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -134,20 +81,7 @@
       "aws:ResourceTag/${TagKey}",
       "aws:TagKeys"
     ],
-    "dependentActions": [
-      "iam:CreateRole",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:PutRolePolicy",
-      "lakeformation:GrantPermissions",
-      "lakeformation:ListPermissions",
-      "lakeformation:RegisterResource",
-      "lakeformation:RevokePermissions",
-      "ram:GetResourceShareAssociations",
-      "ram:GetResourceShares",
-      "ram:UpdateResourceShare",
-      "s3:PutObject"
-    ]
+    "dependentActions": []
   },
   "createsubscribernotification": {
     "name": "CreateSubscriberNotification",
@@ -162,25 +96,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:CreateApiDestination",
-      "events:CreateConnection",
-      "events:DescribeRule",
-      "events:ListApiDestinations",
-      "events:ListConnections",
-      "events:PutRule",
-      "events:PutTargets",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:PassRole",
-      "s3:GetBucketNotification",
-      "s3:PutBucketNotification",
-      "sqs:CreateQueue",
-      "sqs:DeleteQueue",
-      "sqs:GetQueueAttributes",
-      "sqs:GetQueueUrl",
-      "sqs:SetQueueAttributes"
-    ]
+    "dependentActions": []
   },
   "deleteawslogsource": {
     "name": "DeleteAwsLogSource",
@@ -210,9 +126,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "glue:StopCrawlerSchedule"
-    ]
+    "dependentActions": []
   },
   "deletedatalake": {
     "name": "DeleteDataLake",
@@ -227,11 +141,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "organizations:DescribeOrganization",
-      "organizations:ListDelegatedAdministrators",
-      "organizations:ListDelegatedServicesForAccount"
-    ]
+    "dependentActions": []
   },
   "deletedatalakeexceptionsubscription": {
     "name": "DeleteDataLakeExceptionSubscription",
@@ -269,23 +179,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:DeleteApiDestination",
-      "events:DeleteConnection",
-      "events:DeleteRule",
-      "events:DescribeRule",
-      "events:ListApiDestinations",
-      "events:ListTargetsByRule",
-      "events:RemoveTargets",
-      "iam:DeleteRole",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:ListRolePolicies",
-      "lakeformation:ListPermissions",
-      "lakeformation:RevokePermissions",
-      "sqs:DeleteQueue",
-      "sqs:GetQueueUrl"
-    ]
+    "dependentActions": []
   },
   "deletesubscribernotification": {
     "name": "DeleteSubscriberNotification",
@@ -300,22 +194,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:DeleteApiDestination",
-      "events:DeleteConnection",
-      "events:DeleteRule",
-      "events:DescribeRule",
-      "events:ListApiDestinations",
-      "events:ListTargetsByRule",
-      "events:RemoveTargets",
-      "iam:DeleteRole",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:ListRolePolicies",
-      "lakeformation:RevokePermissions",
-      "sqs:DeleteQueue",
-      "sqs:GetQueueUrl"
-    ]
+    "dependentActions": []
   },
   "deregisterdatalakedelegatedadministrator": {
     "name": "DeregisterDataLakeDelegatedAdministrator",
@@ -323,11 +202,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "organizations:DeregisterDelegatedAdministrator",
-      "organizations:DescribeOrganization",
-      "organizations:ListDelegatedServicesForAccount"
-    ]
+    "dependentActions": []
   },
   "getdatalakeexceptionsubscription": {
     "name": "GetDataLakeExceptionSubscription",
@@ -350,9 +225,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "organizations:DescribeOrganization"
-    ]
+    "dependentActions": []
   },
   "getdatalakesources": {
     "name": "GetDataLakeSources",
@@ -443,19 +316,12 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "iam:CreateServiceLinkedRole",
-      "organizations:DescribeOrganization",
-      "organizations:EnableAWSServiceAccess",
-      "organizations:ListDelegatedAdministrators",
-      "organizations:ListDelegatedServicesForAccount",
-      "organizations:RegisterDelegatedAdministrator"
-    ]
+    "dependentActions": []
   },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add tags to the resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "data-lake",
@@ -479,7 +345,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from the resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "data-lake",
@@ -512,34 +378,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:PutRule",
-      "events:PutTargets",
-      "iam:CreateServiceLinkedRole",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:ListAttachedRolePolicies",
-      "iam:PutRolePolicy",
-      "kms:CreateGrant",
-      "kms:DescribeKey",
-      "lakeformation:GetDataLakeSettings",
-      "lakeformation:PutDataLakeSettings",
-      "lambda:AddPermission",
-      "lambda:CreateEventSourceMapping",
-      "lambda:CreateFunction",
-      "organizations:DescribeOrganization",
-      "organizations:ListDelegatedServicesForAccount",
-      "s3:CreateBucket",
-      "s3:GetObject",
-      "s3:GetObjectVersion",
-      "s3:ListBucket",
-      "s3:PutBucketPolicy",
-      "s3:PutBucketPublicAccessBlock",
-      "s3:PutBucketVersioning",
-      "sqs:CreateQueue",
-      "sqs:GetQueueAttributes",
-      "sqs:SetQueueAttributes"
-    ]
+    "dependentActions": []
   },
   "updatedatalakeexceptionsubscription": {
     "name": "UpdateDataLakeExceptionSubscription",
@@ -562,18 +401,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:CreateApiDestination",
-      "events:CreateConnection",
-      "events:DescribeRule",
-      "events:ListApiDestinations",
-      "events:ListConnections",
-      "events:PutRule",
-      "events:PutTargets",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:PutRolePolicy"
-    ]
+    "dependentActions": []
   },
   "updatesubscribernotification": {
     "name": "UpdateSubscriberNotification",
@@ -588,32 +416,6 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "events:CreateApiDestination",
-      "events:CreateConnection",
-      "events:DescribeRule",
-      "events:ListApiDestinations",
-      "events:ListConnections",
-      "events:PutRule",
-      "events:PutTargets",
-      "iam:CreateServiceLinkedRole",
-      "iam:DeleteRolePolicy",
-      "iam:GetRole",
-      "iam:PassRole",
-      "iam:PutRolePolicy",
-      "s3:CreateBucket",
-      "s3:GetBucketNotification",
-      "s3:ListBucket",
-      "s3:PutBucketNotification",
-      "s3:PutBucketPolicy",
-      "s3:PutBucketPublicAccessBlock",
-      "s3:PutBucketVersioning",
-      "s3:PutLifecycleConfiguration",
-      "sqs:CreateQueue",
-      "sqs:DeleteQueue",
-      "sqs:GetQueueAttributes",
-      "sqs:GetQueueUrl",
-      "sqs:SetQueueAttributes"
-    ]
+    "dependentActions": []
   }
 }

package/data/actions/servicecatalog.json

@@ -1,4 +1,67 @@
 {
+  "deleteresourcepolicy": {
+    "name": "DeleteResourcePolicy",
+    "description": "Grants permission to delete a resource-based policy for the specified resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Application",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "AttributeGroup",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourcepolicy": {
+    "name": "GetResourcePolicy",
+    "description": "Grants permission to get a resource-based policy for the specified resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Application",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "AttributeGroup",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putresourcepolicy": {
+    "name": "PutResourcePolicy",
+    "description": "Grants permission to add a resource-based policy for the specified resource",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Application",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "AttributeGroup",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "acceptportfolioshare": {
     "name": "AcceptPortfolioShare",
     "description": "Grants permission to accept a portfolio that has been shared with you",
@@ -75,17 +138,12 @@
         "name": "Application",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "cloudformation:DescribeStacks",
-          "resource-groups:CreateGroup",
-          "resource-groups:GetGroup",
-          "resource-groups:Tag"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "servicecatalog:ResourceType",
-      "servicecatalog:Resource"
+      "servicecatalog:Resource",
+      "servicecatalog:ResourceType"
     ],
     "dependentActions": []
   },
@@ -158,9 +216,7 @@
         "name": "Application",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -223,7 +279,7 @@
   "createportfolioshare": {
     "name": "CreatePortfolioShare",
     "description": "Grants permission to share a portfolio you own with another AWS account",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "Portfolio",
@@ -352,7 +408,7 @@
   "deleteportfolioshare": {
     "name": "DeletePortfolioShare",
     "description": "Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "Portfolio",
@@ -406,28 +462,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "deleteresourcepolicy": {
-    "name": "DeleteResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to delete a resource-based policy for the specified resource",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "Application",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "AttributeGroup",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "deleteserviceaction": {
     "name": "DeleteServiceAction",
     "description": "Grants permission to delete a self-service action",
@@ -699,14 +733,12 @@
         "name": "Application",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "resource-groups:DeleteGroup"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "servicecatalog:ResourceType",
-      "servicecatalog:Resource"
+      "servicecatalog:Resource",
+      "servicecatalog:ResourceType"
     ],
     "dependentActions": []
   },
@@ -814,8 +846,8 @@
       }
     ],
     "conditionKeys": [
-      "servicecatalog:ResourceType",
-      "servicecatalog:Resource"
+      "servicecatalog:Resource",
+      "servicecatalog:ResourceType"
     ],
     "dependentActions": []
   },
@@ -850,28 +882,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getresourcepolicy": {
-    "name": "GetResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get a resource-based policy for the specified resource",
-    "accessLevel": "Read",
-    "resourceTypes": [
-      {
-        "name": "Application",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "AttributeGroup",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "importasprovisionedproduct": {
     "name": "ImportAsProvisionedProduct",
     "description": "Grants permission to import a resource into a provisioned product",
@@ -1218,28 +1228,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "putresourcepolicy": {
-    "name": "PutResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to add a resource-based policy for the specified resource",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "Application",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "AttributeGroup",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "rejectportfolioshare": {
     "name": "RejectPortfolioShare",
     "description": "Grants permission to reject a portfolio that has been shared with you that you previously accepted",
@@ -1301,14 +1289,12 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "cloudformation:UpdateStack"
-    ]
+    "dependentActions": []
   },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag a service catalog appregistry resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Application",
@@ -1324,8 +1310,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -1344,7 +1330,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove a tag from a service catalog appregistry resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Application",
@@ -1377,9 +1363,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "iam:CreateServiceLinkedRole"
-    ]
+    "dependentActions": []
   },
   "updateattributegroup": {
     "name": "UpdateAttributeGroup",
@@ -1425,7 +1409,7 @@
   "updateportfolioshare": {
     "name": "UpdatePortfolioShare",
     "description": "Grants permission to enable or disable resource sharing for an existing portfolio share",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "Portfolio",