@cloud-copilot/iam-data 0.19.202607021 → 0.19.202607151

package/data/actions/shield.json

@@ -1,14 +1,55 @@
 {
+  "describeattackcontributors": {
+    "name": "DescribeAttackContributors",
+    "description": "Grants permission to get detailed information about the contributors to a specific DDoS attack",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "attack",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "protection-group",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getglobalthreatdata": {
+    "name": "GetGlobalThreatData",
+    "description": "Grants permission to retrieve global threat intelligence data and trends from AWS Shield's threat monitoring systems",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmitigations": {
+    "name": "ListMitigations",
+    "description": "Grants permission to retrieve a list of mitigation actions that have been applied during DDoS attacks",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "attack",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "associatedrtlogbucket": {
     "name": "AssociateDRTLogBucket",
     "description": "Grants permission to authorize the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs",
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "s3:GetBucketPolicy",
-      "s3:PutBucketPolicy"
-    ]
+    "dependentActions": []
   },
   "associatedrtrole": {
     "name": "AssociateDRTRole",
@@ -16,11 +57,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "iam:GetRole",
-      "iam:ListAttachedRolePolicies",
-      "iam:PassRole"
-    ]
+    "dependentActions": []
   },
   "associatehealthcheck": {
     "name": "AssociateHealthCheck",
@@ -31,9 +68,7 @@
         "name": "protection",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "route53:GetHealthCheck"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -136,28 +171,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "describeattackcontributors": {
-    "name": "DescribeAttackContributors",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get detailed information about the contributors to a specific DDoS attack",
-    "accessLevel": "Read",
-    "resourceTypes": [
-      {
-        "name": "attack",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "protection-group",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "describeattackstatistics": {
     "name": "DescribeAttackStatistics",
     "description": "Grants permission to describe information about the number and type of attacks AWS Shield has detected in the last year",
@@ -246,11 +259,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "s3:DeleteBucketPolicy",
-      "s3:GetBucketPolicy",
-      "s3:PutBucketPolicy"
-    ]
+    "dependentActions": []
   },
   "disassociatedrtrole": {
     "name": "DisassociateDRTRole",
@@ -283,16 +292,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "apprunner:DescribeWebAclForService",
-      "cloudfront:GetDistribution",
-      "cognito-idp:GetWebACLForResource",
-      "ec2:GetVerifiedAccessInstanceWebAcl",
-      "iam:CreateServiceLinkedRole",
-      "iam:GetRole",
-      "wafv2:GetWebACL",
-      "wafv2:GetWebACLForResource"
-    ]
+    "dependentActions": []
   },
   "enableproactiveengagement": {
     "name": "EnableProactiveEngagement",
@@ -302,15 +302,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getglobalthreatdata": {
-    "name": "GetGlobalThreatData",
-    "isPermissionOnly": true,
-    "description": "Grants permission to retrieve global threat intelligence data and trends from AWS Shield's threat monitoring systems",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "getsubscriptionstate": {
     "name": "GetSubscriptionState",
     "description": "Grants permission to get subscription state",
@@ -327,22 +318,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listmitigations": {
-    "name": "ListMitigations",
-    "isPermissionOnly": true,
-    "description": "Grants permission to retrieve a list of mitigation actions that have been applied during DDoS attacks",
-    "accessLevel": "List",
-    "resourceTypes": [
-      {
-        "name": "attack",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listprotectiongroups": {
     "name": "ListProtectionGroups",
     "description": "Grants permission to retrieve the protection groups for the account",
@@ -398,7 +373,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add or updates tags for a resource in AWS Shield",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "protection",
@@ -422,7 +397,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from a resource in AWS Shield",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "protection",
@@ -448,13 +423,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "apprunner:DescribeWebAclForService",
-      "cognito-idp:GetWebACLForResource",
-      "ec2:GetVerifiedAccessInstanceWebAcl",
-      "wafv2:GetWebACL",
-      "wafv2:GetWebACLForResource"
-    ]
+    "dependentActions": []
   },
   "updateemergencycontactsettings": {
     "name": "UpdateEmergencyContactSettings",

package/data/actions/signer.json

@@ -2,7 +2,7 @@
   "addprofilepermission": {
     "name": "AddProfilePermission",
     "description": "Grants permission to add cross-account permissions to a Signing Profile",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "signing-profile",
@@ -160,7 +160,7 @@
   "removeprofilepermission": {
     "name": "RemoveProfilePermission",
     "description": "Grants permission to remove cross-account permissions from a Signing Profile",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "signing-profile",
@@ -243,7 +243,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add one or more tags to a Signing Profile",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "signing-profile",
@@ -253,15 +253,15 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove one or more tags from a Signing Profile",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "signing-profile",
@@ -271,8 +271,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   }

package/data/actions/signin.json

@@ -1,4 +1,19 @@
 {
+  "createaccount": {
+    "name": "CreateAccount",
+    "description": "Grants permission to create an AWS account through the AWS Management Console sign-up flow",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "console",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "authenticate": {
     "name": "Authenticate",
     "description": "Grants permission to authenticate to the AWS Management Console",
@@ -30,33 +45,49 @@
       {
         "name": "oauth2-public-client-localhost",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "signin:OAuthClientId",
+          "signin:OAuthRedirectUri"
+        ],
         "dependentActions": []
       },
       {
         "name": "oauth2-public-client-remote",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "signin:OAuthClientId",
+          "signin:OAuthRedirectUri"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-resource-service-principal",
+        "required": true,
+        "conditionKeys": [
+          "signin:OAuthClientId",
+          "signin:OAuthRedirectUri"
+        ],
         "dependentActions": []
       }
     ],
     "conditionKeys": [],
     "dependentActions": []
   },
-  "createaccount": {
-    "name": "CreateAccount",
-    "isPermissionOnly": true,
-    "description": "Grants permission to create an AWS account through the AWS Management Console sign-up flow",
+  "createoauth2publicclient": {
+    "name": "CreateOAuth2PublicClient",
+    "description": "Grants permission to dynamically register an OAuth 2.0 public client for use with AWS Sign-In",
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "console",
+        "name": "oauth2-public-client-registration",
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "signin:OAuthRedirectUri"
+    ],
     "dependentActions": []
   },
   "createoauth2token": {
@@ -73,13 +104,34 @@
       {
         "name": "oauth2-public-client-localhost",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "signin:OAuthClientAuthentication",
+          "signin:OAuthClientId",
+          "signin:OAuthGrantType",
+          "signin:OAuthRedirectUri"
+        ],
         "dependentActions": []
       },
       {
         "name": "oauth2-public-client-remote",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "signin:OAuthClientAuthentication",
+          "signin:OAuthClientId",
+          "signin:OAuthGrantType",
+          "signin:OAuthRedirectUri"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-resource-service-principal",
+        "required": true,
+        "conditionKeys": [
+          "signin:OAuthClientAuthentication",
+          "signin:OAuthClientId",
+          "signin:OAuthGrantType",
+          "signin:OAuthRedirectUri"
+        ],
         "dependentActions": []
       }
     ],
@@ -92,15 +144,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "sso:CreateApplication",
-      "sso:GetSharedSsoConfiguration",
-      "sso:ListApplications",
-      "sso:PutApplicationAccessScope",
-      "sso:PutApplicationAssignmentConfiguration",
-      "sso:PutApplicationAuthenticationMethod",
-      "sso:PutApplicationGrant"
-    ]
+    "dependentActions": []
   },
   "deleteconsoleauthorizationconfiguration": {
     "name": "DeleteConsoleAuthorizationConfiguration",
@@ -134,6 +178,36 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "introspectoauth2token": {
+    "name": "IntrospectOAuth2Token",
+    "description": "Grants permission to inspect the metadata and active state of an OAuth 2.0 access token or refresh token",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2-public-client-localhost",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-public-client-remote",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-resource-service-principal",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "signin:OAuthClientId",
+      "signin:OAuthTokenType"
+    ],
+    "dependentActions": []
+  },
   "listresourcepermissionstatements": {
     "name": "ListResourcePermissionStatements",
     "description": "Grants permission to list the SignIn Resource Based Policy statements in your account",
@@ -148,10 +222,7 @@
     "accessLevel": "List",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "sso:GetSharedSsoConfiguration",
-      "sso:ListApplications"
-    ]
+    "dependentActions": []
   },
   "putconsoleauthorizationconfiguration": {
     "name": "PutConsoleAuthorizationConfiguration",
@@ -168,5 +239,34 @@
     "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
+  },
+  "revokeoauth2token": {
+    "name": "RevokeOAuth2Token",
+    "description": "Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "oauth2-public-client-localhost",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-public-client-remote",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "oauth2-resource-service-principal",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "signin:OAuthTokenType"
+    ],
+    "dependentActions": []
   }
 }

package/data/actions/simspaceweaver.json

@@ -7,7 +7,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -22,7 +24,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -37,7 +41,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -52,7 +58,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -67,7 +75,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -82,7 +92,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -113,7 +125,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -128,7 +142,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -154,7 +170,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -169,7 +187,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -184,7 +204,9 @@
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -194,36 +216,38 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to untag a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Simulation",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   }
 }