@cloud-copilot/iam-data 0.19.202607021 → 0.19.202607151

package/data/conditionKeys/sts.json

@@ -4,6 +4,11 @@
     "description": "Filters access by the Google application ID",
     "type": "String"
   },
+  "accounts.google.com:google/organization_number": {
+    "key": "accounts.google.com:google/organization_number",
+    "description": "Filters access by the Google Cloud or Google Workspace organization number",
+    "type": "Numeric"
+  },
   "accounts.google.com:oaud": {
     "key": "accounts.google.com:oaud",
     "description": "Filters access by the Google audience",
@@ -14,6 +19,111 @@
     "description": "Filters access by the subject of the claim (the Google user ID)",
     "type": "String"
   },
+  "agent.${domain}.buildkite.dev:build_branch": {
+    "key": "agent.${Domain}.buildkite.dev:build_branch",
+    "description": "Filters access by the git branch that triggered the Buildkite build",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:cluster_id": {
+    "key": "agent.${Domain}.buildkite.dev:cluster_id",
+    "description": "Filters access by the Buildkite cluster ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:cluster_name": {
+    "key": "agent.${Domain}.buildkite.dev:cluster_name",
+    "description": "Filters access by the Buildkite cluster name",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:organization_id": {
+    "key": "agent.${Domain}.buildkite.dev:organization_id",
+    "description": "Filters access by the Buildkite organization ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:organization_slug": {
+    "key": "agent.${Domain}.buildkite.dev:organization_slug",
+    "description": "Filters access by the Buildkite organization slug",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:pipeline_id": {
+    "key": "agent.${Domain}.buildkite.dev:pipeline_id",
+    "description": "Filters access by the Buildkite pipeline ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.dev:pipeline_slug": {
+    "key": "agent.${Domain}.buildkite.dev:pipeline_slug",
+    "description": "Filters access by the Buildkite pipeline slug",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:build_branch": {
+    "key": "agent.${Domain}.buildkite.site:build_branch",
+    "description": "Filters access by the git branch that triggered the Buildkite build",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:cluster_id": {
+    "key": "agent.${Domain}.buildkite.site:cluster_id",
+    "description": "Filters access by the Buildkite cluster ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:cluster_name": {
+    "key": "agent.${Domain}.buildkite.site:cluster_name",
+    "description": "Filters access by the Buildkite cluster name",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:organization_id": {
+    "key": "agent.${Domain}.buildkite.site:organization_id",
+    "description": "Filters access by the Buildkite organization ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:organization_slug": {
+    "key": "agent.${Domain}.buildkite.site:organization_slug",
+    "description": "Filters access by the Buildkite organization slug",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:pipeline_id": {
+    "key": "agent.${Domain}.buildkite.site:pipeline_id",
+    "description": "Filters access by the Buildkite pipeline ID",
+    "type": "String"
+  },
+  "agent.${domain}.buildkite.site:pipeline_slug": {
+    "key": "agent.${Domain}.buildkite.site:pipeline_slug",
+    "description": "Filters access by the Buildkite pipeline slug",
+    "type": "String"
+  },
+  "agent.buildkite.com:build_branch": {
+    "key": "agent.buildkite.com:build_branch",
+    "description": "Filters access by the git branch that triggered the Buildkite build",
+    "type": "String"
+  },
+  "agent.buildkite.com:cluster_id": {
+    "key": "agent.buildkite.com:cluster_id",
+    "description": "Filters access by the Buildkite cluster ID",
+    "type": "String"
+  },
+  "agent.buildkite.com:cluster_name": {
+    "key": "agent.buildkite.com:cluster_name",
+    "description": "Filters access by the Buildkite cluster name",
+    "type": "String"
+  },
+  "agent.buildkite.com:organization_id": {
+    "key": "agent.buildkite.com:organization_id",
+    "description": "Filters access by the Buildkite organization ID",
+    "type": "String"
+  },
+  "agent.buildkite.com:organization_slug": {
+    "key": "agent.buildkite.com:organization_slug",
+    "description": "Filters access by the Buildkite organization slug",
+    "type": "String"
+  },
+  "agent.buildkite.com:pipeline_id": {
+    "key": "agent.buildkite.com:pipeline_id",
+    "description": "Filters access by the Buildkite pipeline ID",
+    "type": "String"
+  },
+  "agent.buildkite.com:pipeline_slug": {
+    "key": "agent.buildkite.com:pipeline_slug",
+    "description": "Filters access by the Buildkite pipeline slug",
+    "type": "String"
+  },
   "aws:requesttag/${tagkey}": {
     "key": "aws:RequestTag/${TagKey}",
     "description": "Filters access by the tags that are passed in the request",
@@ -44,6 +154,101 @@
     "description": "Filters access by the subject of the claim (the Amazon Cognito user ID)",
     "type": "String"
   },
+  "github.com/enterprises/${enterprisename}:actor": {
+    "key": "github.com/enterprises/${EnterpriseName}:actor",
+    "description": "Filters access by the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:actor_id": {
+    "key": "github.com/enterprises/${EnterpriseName}:actor_id",
+    "description": "Filters access by the ID of the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:enterprise_id": {
+    "key": "github.com/enterprises/${EnterpriseName}:enterprise_id",
+    "description": "Filters access by the ID of the enterprise that contains the repository from where the workflow is running",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:environment": {
+    "key": "github.com/enterprises/${EnterpriseName}:environment",
+    "description": "Filters access by the name of the environment used by the job",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:job_workflow_ref": {
+    "key": "github.com/enterprises/${EnterpriseName}:job_workflow_ref",
+    "description": "Filters access by the reference path to the reusable workflow for jobs using a reusable workflow",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:ref": {
+    "key": "github.com/enterprises/${EnterpriseName}:ref",
+    "description": "Filters access by the git ref (branch or tag) that triggered the workflow run",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:repository": {
+    "key": "github.com/enterprises/${EnterpriseName}:repository",
+    "description": "Filters access by the repository from where the workflow is running",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:repository_id": {
+    "key": "github.com/enterprises/${EnterpriseName}:repository_id",
+    "description": "Filters access by the ID of the repository from where the workflow is running",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:repository_owner_id": {
+    "key": "github.com/enterprises/${EnterpriseName}:repository_owner_id",
+    "description": "Filters access by the ID of the repository owner from where the workflow is running",
+    "type": "String"
+  },
+  "github.com/enterprises/${enterprisename}:workflow": {
+    "key": "github.com/enterprises/${EnterpriseName}:workflow",
+    "description": "Filters access by the name of the workflow",
+    "type": "String"
+  },
+  "gitlab.com:namespace_id": {
+    "key": "gitlab.com:namespace_id",
+    "description": "Filters access by the GitLab namespace (group) ID of the project running the CI/CD job",
+    "type": "String"
+  },
+  "gitlab.com:pipeline_source": {
+    "key": "gitlab.com:pipeline_source",
+    "description": "Filters access by the source that triggered the GitLab pipeline",
+    "type": "String"
+  },
+  "gitlab.com:project_id": {
+    "key": "gitlab.com:project_id",
+    "description": "Filters access by the GitLab project ID running the CI/CD job",
+    "type": "String"
+  },
+  "gitlab.com:ref_protected": {
+    "key": "gitlab.com:ref_protected",
+    "description": "Filters access by whether the GitLab git ref that triggered the job is protected",
+    "type": "String"
+  },
+  "gitlab.com:runner_environment": {
+    "key": "gitlab.com:runner_environment",
+    "description": "Filters access by the GitLab runner environment for the CI/CD job",
+    "type": "String"
+  },
+  "gitlab.com:user_access_level": {
+    "key": "gitlab.com:user_access_level",
+    "description": "Filters access by the GitLab user access level within the project",
+    "type": "String"
+  },
+  "gitlab.com:user_email": {
+    "key": "gitlab.com:user_email",
+    "description": "Filters access by the GitLab user email executing the CI/CD job",
+    "type": "String"
+  },
+  "gitlab.com:user_id": {
+    "key": "gitlab.com:user_id",
+    "description": "Filters access by the GitLab user ID executing the CI/CD job",
+    "type": "String"
+  },
+  "gitlab.com:user_login": {
+    "key": "gitlab.com:user_login",
+    "description": "Filters access by the GitLab username executing the CI/CD job",
+    "type": "String"
+  },
   "graph.facebook.com:app_id": {
     "key": "graph.facebook.com:app_id",
     "description": "Filters access by the Facebook application ID",
@@ -59,6 +264,16 @@
     "description": "Filters access by the tags that are attached to the role that is being assumed",
     "type": "String"
   },
+  "idcs-${ociuniqueidentifier}.identity.oraclecloud.com:rpst_id": {
+    "key": "idcs-${OciUniqueIdentifier}.identity.oraclecloud.com:rpst_id",
+    "description": "Filters access by the OCI resource principal session token ID",
+    "type": "String"
+  },
+  "oidc.circleci.com/org/${orgid}:oidc.circleci.com/project-id": {
+    "key": "oidc.circleci.com/org/${OrgId}:oidc.circleci.com/project-id",
+    "description": "Filters access by the CircleCI project ID",
+    "type": "String"
+  },
   "saml:aud": {
     "key": "saml:aud",
     "description": "Filters access by the endpoint URL to which SAML assertions are presented",
@@ -249,6 +464,11 @@
     "description": "Filters access by the context provider ARNs",
     "type": "ArrayOfARN"
   },
+  "sts:roleauthorizedbyidp": {
+    "key": "sts:RoleAuthorizedByIdp",
+    "description": "Filters access based on whether the identity provider authorized the role via the roles claim in the OIDC token",
+    "type": "Bool"
+  },
   "sts:rolesessionname": {
     "key": "sts:RoleSessionName",
     "description": "Filters access by the role session name required when you assume a role",
@@ -274,6 +494,156 @@
     "description": "Filters access by the transitive tag keys that are passed in the request",
     "type": "ArrayOfString"
   },
+  "token.actions.${domain}.ghe.com:actor": {
+    "key": "token.actions.${Domain}.ghe.com:actor",
+    "description": "Filters access by the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:actor_id": {
+    "key": "token.actions.${Domain}.ghe.com:actor_id",
+    "description": "Filters access by the ID of the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:enterprise_id": {
+    "key": "token.actions.${Domain}.ghe.com:enterprise_id",
+    "description": "Filters access by the ID of the enterprise that contains the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:environment": {
+    "key": "token.actions.${Domain}.ghe.com:environment",
+    "description": "Filters access by the name of the environment used by the job",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:job_workflow_ref": {
+    "key": "token.actions.${Domain}.ghe.com:job_workflow_ref",
+    "description": "Filters access by the reference path to the reusable workflow for jobs using a reusable workflow",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:ref": {
+    "key": "token.actions.${Domain}.ghe.com:ref",
+    "description": "Filters access by the git ref (branch or tag) that triggered the workflow run",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:repository": {
+    "key": "token.actions.${Domain}.ghe.com:repository",
+    "description": "Filters access by the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:repository_id": {
+    "key": "token.actions.${Domain}.ghe.com:repository_id",
+    "description": "Filters access by the ID of the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:repository_owner_id": {
+    "key": "token.actions.${Domain}.ghe.com:repository_owner_id",
+    "description": "Filters access by the ID of the repository owner from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.${domain}.ghe.com:workflow": {
+    "key": "token.actions.${Domain}.ghe.com:workflow",
+    "description": "Filters access by the name of the workflow",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:actor": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:actor",
+    "description": "Filters access by the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:actor_id": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:actor_id",
+    "description": "Filters access by the ID of the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:enterprise_id": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:enterprise_id",
+    "description": "Filters access by the ID of the enterprise that contains the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:environment": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:environment",
+    "description": "Filters access by the name of the environment used by the job",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:job_workflow_ref": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:job_workflow_ref",
+    "description": "Filters access by the reference path to the reusable workflow for jobs using a reusable workflow",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:ref": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:ref",
+    "description": "Filters access by the git ref (branch or tag) that triggered the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:repository": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:repository",
+    "description": "Filters access by the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:repository_id": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:repository_id",
+    "description": "Filters access by the ID of the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:repository_owner_id": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:repository_owner_id",
+    "description": "Filters access by the ID of the repository owner from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com/${subpath}:workflow": {
+    "key": "token.actions.githubusercontent.com/${SubPath}:workflow",
+    "description": "Filters access by the name of the workflow",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:actor": {
+    "key": "token.actions.githubusercontent.com:actor",
+    "description": "Filters access by the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:actor_id": {
+    "key": "token.actions.githubusercontent.com:actor_id",
+    "description": "Filters access by the ID of the personal account that initiated the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:enterprise_id": {
+    "key": "token.actions.githubusercontent.com:enterprise_id",
+    "description": "Filters access by the ID of the enterprise that contains the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:environment": {
+    "key": "token.actions.githubusercontent.com:environment",
+    "description": "Filters access by the name of the environment used by the job",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:job_workflow_ref": {
+    "key": "token.actions.githubusercontent.com:job_workflow_ref",
+    "description": "Filters access by the reference path to the reusable workflow for jobs using a reusable workflow",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:ref": {
+    "key": "token.actions.githubusercontent.com:ref",
+    "description": "Filters access by the git ref (branch or tag) that triggered the workflow run",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:repository": {
+    "key": "token.actions.githubusercontent.com:repository",
+    "description": "Filters access by the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:repository_id": {
+    "key": "token.actions.githubusercontent.com:repository_id",
+    "description": "Filters access by the ID of the repository from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:repository_owner_id": {
+    "key": "token.actions.githubusercontent.com:repository_owner_id",
+    "description": "Filters access by the ID of the repository owner from where the workflow is running",
+    "type": "String"
+  },
+  "token.actions.githubusercontent.com:workflow": {
+    "key": "token.actions.githubusercontent.com:workflow",
+    "description": "Filters access by the name of the workflow",
+    "type": "String"
+  },
   "www.amazon.com:app_id": {
     "key": "www.amazon.com:app_id",
     "description": "Filters access by the Login with Amazon application ID",

package/data/conditionKeys/supportauthz.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key-value pair in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by a tag key-value pair assigned to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionPatterns.json

@@ -63,9 +63,69 @@
     "securityhub:ASFFSyntaxPath/.+?": "securityhub:ASFFSyntaxPath/${ASFFSyntaxPath}",
     "securityhub:OCSFSyntaxPath/.+?": "securityhub:OCSFSyntaxPath/${OCSFSyntaxPath}"
   },
+  "agent.${Domain}.buildkite.dev": {
+    "agent..+?.buildkite.dev:build_branch": "agent.${Domain}.buildkite.dev:build_branch",
+    "agent..+?.buildkite.dev:cluster_id": "agent.${Domain}.buildkite.dev:cluster_id",
+    "agent..+?.buildkite.dev:cluster_name": "agent.${Domain}.buildkite.dev:cluster_name",
+    "agent..+?.buildkite.dev:organization_id": "agent.${Domain}.buildkite.dev:organization_id",
+    "agent..+?.buildkite.dev:organization_slug": "agent.${Domain}.buildkite.dev:organization_slug",
+    "agent..+?.buildkite.dev:pipeline_id": "agent.${Domain}.buildkite.dev:pipeline_id",
+    "agent..+?.buildkite.dev:pipeline_slug": "agent.${Domain}.buildkite.dev:pipeline_slug"
+  },
+  "agent.${Domain}.buildkite.site": {
+    "agent..+?.buildkite.site:build_branch": "agent.${Domain}.buildkite.site:build_branch",
+    "agent..+?.buildkite.site:cluster_id": "agent.${Domain}.buildkite.site:cluster_id",
+    "agent..+?.buildkite.site:cluster_name": "agent.${Domain}.buildkite.site:cluster_name",
+    "agent..+?.buildkite.site:organization_id": "agent.${Domain}.buildkite.site:organization_id",
+    "agent..+?.buildkite.site:organization_slug": "agent.${Domain}.buildkite.site:organization_slug",
+    "agent..+?.buildkite.site:pipeline_id": "agent.${Domain}.buildkite.site:pipeline_id",
+    "agent..+?.buildkite.site:pipeline_slug": "agent.${Domain}.buildkite.site:pipeline_slug"
+  },
+  "github.com/enterprises/${EnterpriseName}": {
+    "github.com/enterprises/.+?:actor": "github.com/enterprises/${EnterpriseName}:actor",
+    "github.com/enterprises/.+?:actor_id": "github.com/enterprises/${EnterpriseName}:actor_id",
+    "github.com/enterprises/.+?:enterprise_id": "github.com/enterprises/${EnterpriseName}:enterprise_id",
+    "github.com/enterprises/.+?:environment": "github.com/enterprises/${EnterpriseName}:environment",
+    "github.com/enterprises/.+?:job_workflow_ref": "github.com/enterprises/${EnterpriseName}:job_workflow_ref",
+    "github.com/enterprises/.+?:ref": "github.com/enterprises/${EnterpriseName}:ref",
+    "github.com/enterprises/.+?:repository": "github.com/enterprises/${EnterpriseName}:repository",
+    "github.com/enterprises/.+?:repository_id": "github.com/enterprises/${EnterpriseName}:repository_id",
+    "github.com/enterprises/.+?:repository_owner_id": "github.com/enterprises/${EnterpriseName}:repository_owner_id",
+    "github.com/enterprises/.+?:workflow": "github.com/enterprises/${EnterpriseName}:workflow"
+  },
+  "idcs-${OciUniqueIdentifier}.identity.oraclecloud.com": {
+    "idcs-.+?.identity.oraclecloud.com:rpst_id": "idcs-${OciUniqueIdentifier}.identity.oraclecloud.com:rpst_id"
+  },
+  "oidc.circleci.com/org/${OrgId}": {
+    "oidc.circleci.com/org/.+?:oidc.circleci.com/project-id": "oidc.circleci.com/org/${OrgId}:oidc.circleci.com/project-id"
+  },
   "sts": {
     "sts:RequestContext/.+?": "sts:RequestContext/${ContextKey}"
   },
+  "token.actions.${Domain}.ghe.com": {
+    "token.actions..+?.ghe.com:actor": "token.actions.${Domain}.ghe.com:actor",
+    "token.actions..+?.ghe.com:actor_id": "token.actions.${Domain}.ghe.com:actor_id",
+    "token.actions..+?.ghe.com:enterprise_id": "token.actions.${Domain}.ghe.com:enterprise_id",
+    "token.actions..+?.ghe.com:environment": "token.actions.${Domain}.ghe.com:environment",
+    "token.actions..+?.ghe.com:job_workflow_ref": "token.actions.${Domain}.ghe.com:job_workflow_ref",
+    "token.actions..+?.ghe.com:ref": "token.actions.${Domain}.ghe.com:ref",
+    "token.actions..+?.ghe.com:repository": "token.actions.${Domain}.ghe.com:repository",
+    "token.actions..+?.ghe.com:repository_id": "token.actions.${Domain}.ghe.com:repository_id",
+    "token.actions..+?.ghe.com:repository_owner_id": "token.actions.${Domain}.ghe.com:repository_owner_id",
+    "token.actions..+?.ghe.com:workflow": "token.actions.${Domain}.ghe.com:workflow"
+  },
+  "token.actions.githubusercontent.com/${SubPath}": {
+    "token.actions.githubusercontent.com/.+?:actor": "token.actions.githubusercontent.com/${SubPath}:actor",
+    "token.actions.githubusercontent.com/.+?:actor_id": "token.actions.githubusercontent.com/${SubPath}:actor_id",
+    "token.actions.githubusercontent.com/.+?:enterprise_id": "token.actions.githubusercontent.com/${SubPath}:enterprise_id",
+    "token.actions.githubusercontent.com/.+?:environment": "token.actions.githubusercontent.com/${SubPath}:environment",
+    "token.actions.githubusercontent.com/.+?:job_workflow_ref": "token.actions.githubusercontent.com/${SubPath}:job_workflow_ref",
+    "token.actions.githubusercontent.com/.+?:ref": "token.actions.githubusercontent.com/${SubPath}:ref",
+    "token.actions.githubusercontent.com/.+?:repository": "token.actions.githubusercontent.com/${SubPath}:repository",
+    "token.actions.githubusercontent.com/.+?:repository_id": "token.actions.githubusercontent.com/${SubPath}:repository_id",
+    "token.actions.githubusercontent.com/.+?:repository_owner_id": "token.actions.githubusercontent.com/${SubPath}:repository_owner_id",
+    "token.actions.githubusercontent.com/.+?:workflow": "token.actions.githubusercontent.com/${SubPath}:workflow"
+  },
   "ssm": {
     "ssm:resourceTag/.+?": "ssm:resourceTag/${TagKey}"
   },

package/data/resourceTypes/a4b.json

@@ -1,4 +1,35 @@
 {
+  "addressbook": {
+    "key": "addressbook",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:address-book/${ResourceId}"
+  },
+  "conferenceprovider": {
+    "key": "conferenceprovider",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:conference-provider/${ResourceId}"
+  },
+  "contact": {
+    "key": "contact",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:contact/${ResourceId}"
+  },
+  "device": {
+    "key": "device",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:device/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "gateway": {
+    "key": "gateway",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:gateway/${ResourceId}"
+  },
+  "gatewaygroup": {
+    "key": "gatewaygroup",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:gateway-group/${ResourceId}"
+  },
+  "networkprofile": {
+    "key": "networkprofile",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:network-profile/${ResourceId}"
+  },
   "profile": {
     "key": "profile",
     "arn": "arn:${Partition}:a4b:${Region}:${Account}:profile/${ResourceId}"
@@ -10,12 +41,9 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
-  "device": {
-    "key": "device",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:device/${ResourceId}",
-    "conditionKeys": [
-      "aws:ResourceTag/${TagKey}"
-    ]
+  "schedule": {
+    "key": "schedule",
+    "arn": "arn:${Partition}:a4b:${Region}:${Account}:schedule/${ResourceId}"
   },
   "skillgroup": {
     "key": "skillgroup",
@@ -27,33 +55,5 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
-  },
-  "addressbook": {
-    "key": "addressbook",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:address-book/${ResourceId}"
-  },
-  "conferenceprovider": {
-    "key": "conferenceprovider",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:conference-provider/${ResourceId}"
-  },
-  "contact": {
-    "key": "contact",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:contact/${ResourceId}"
-  },
-  "schedule": {
-    "key": "schedule",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:schedule/${ResourceId}"
-  },
-  "networkprofile": {
-    "key": "networkprofile",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:network-profile/${ResourceId}"
-  },
-  "gateway": {
-    "key": "gateway",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:gateway/${ResourceId}"
-  },
-  "gatewaygroup": {
-    "key": "gatewaygroup",
-    "arn": "arn:${Partition}:a4b:${Region}:${Account}:gateway-group/${ResourceId}"
   }
 }

package/data/resourceTypes/acm.json

@@ -1,7 +1,7 @@
 {
-  "certificate": {
-    "key": "certificate",
-    "arn": "arn:${Partition}:acm:${Region}:${Account}:certificate/${CertificateId}",
+  "acme-domain-validation": {
+    "key": "acme-domain-validation",
+    "arn": "arn:${Partition}:acm:${Region}:${Account}:acme-endpoint/${AcmeEndpointId}/acme-domain-validation/${AcmeDomainValidationId}",
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
@@ -13,16 +13,16 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
-  "acme-domain-validation": {
-    "key": "acme-domain-validation",
-    "arn": "arn:${Partition}:acm:${Region}:${Account}:acme-endpoint/${AcmeEndpointId}/acme-domain-validation/${AcmeDomainValidationId}",
+  "acme-external-account-binding": {
+    "key": "acme-external-account-binding",
+    "arn": "arn:${Partition}:acm:${Region}:${Account}:acme-endpoint/${AcmeEndpointId}/acme-external-account-binding/${ExternalAccountBindingId}",
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
   },
-  "acme-external-account-binding": {
-    "key": "acme-external-account-binding",
-    "arn": "arn:${Partition}:acm:${Region}:${Account}:acme-endpoint/${AcmeEndpointId}/acme-external-account-binding/${ExternalAccountBindingId}",
+  "certificate": {
+    "key": "certificate",
+    "arn": "arn:${Partition}:acm:${Region}:${Account}:certificate/${CertificateId}",
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]

package/data/resourceTypes/amplify.json

@@ -13,10 +13,6 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
-  "jobs": {
-    "key": "jobs",
-    "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}/jobs/${JobId}"
-  },
   "domains": {
     "key": "domains",
     "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/domains/${DomainName}",
@@ -24,6 +20,10 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "jobs": {
+    "key": "jobs",
+    "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}/jobs/${JobId}"
+  },
   "webhooks": {
     "key": "webhooks",
     "arn": "arn:${Partition}:amplify:${Region}:${Account}:webhooks/${WebhookId}",