@cloud-copilot/iam-data 0.19.202607021 → 0.19.202607151

package/data/actions/cloudformation.json

@@ -63,6 +63,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createuploadbucket": {
+    "name": "CreateUploadBucket",
+    "description": "Grants permission to upload templates to Amazon S3 buckets. Used only by the AWS CloudFormation console and is not documented in the API reference",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "activateorganizationsaccess": {
     "name": "ActivateOrganizationsAccess",
     "description": "Grants permission to activate trusted access between StackSets and Organizations. With trusted access between StackSets and Organizations activated, the management account has permissions to create and manage StackSets for your organization",
@@ -132,14 +140,14 @@
       }
     ],
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cloudformation:ChangeSetName",
-      "cloudformation:ResourceTypes",
       "cloudformation:ImportResourceTypes",
+      "cloudformation:ResourceTypes",
       "cloudformation:RoleArn",
       "cloudformation:StackPolicyUrl",
-      "cloudformation:TemplateUrl",
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "cloudformation:TemplateUrl"
     ],
     "dependentActions": []
   },
@@ -164,12 +172,12 @@
       }
     ],
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cloudformation:ResourceTypes",
       "cloudformation:RoleArn",
       "cloudformation:StackPolicyUrl",
-      "cloudformation:TemplateUrl",
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "cloudformation:TemplateUrl"
     ],
     "dependentActions": []
   },
@@ -224,22 +232,13 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [
-      "cloudformation:RoleArn",
-      "cloudformation:TemplateUrl",
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "cloudformation:RoleArn",
+      "cloudformation:TemplateUrl"
     ],
     "dependentActions": []
   },
-  "createuploadbucket": {
-    "name": "CreateUploadBucket",
-    "isPermissionOnly": true,
-    "description": "Grants permission to upload templates to Amazon S3 buckets. Used only by the AWS CloudFormation console and is not documented in the API reference",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "deactivateorganizationsaccess": {
     "name": "DeactivateOrganizationsAccess",
     "description": "Grants permission to deactivate trusted access between StackSets and Organizations. If trusted access is deactivated, the management account does not have permissions to create and manage service-managed StackSets for your organization",
@@ -586,9 +585,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "cloudformation:ListStacks"
-    ]
+    "dependentActions": []
   },
   "describetype": {
     "name": "DescribeType",
@@ -709,9 +706,7 @@
     "conditionKeys": [
       "cloudformation:TypeArn"
     ],
-    "dependentActions": [
-      "kms:Decrypt"
-    ]
+    "dependentActions": []
   },
   "getstackpolicy": {
     "name": "GetStackPolicy",
@@ -1090,7 +1085,7 @@
   "setstackpolicy": {
     "name": "SetStackPolicy",
     "description": "Grants permission to set a stack policy for a specified stack",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "stack",
@@ -1161,7 +1156,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag cloudformation resources",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "changeset",
@@ -1183,8 +1178,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
       "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cloudformation:CreateAction"
     ],
     "dependentActions": []
@@ -1200,7 +1195,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to untag cloudformation resources",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "changeset",
@@ -1248,12 +1243,12 @@
       }
     ],
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cloudformation:ResourceTypes",
       "cloudformation:RoleArn",
       "cloudformation:StackPolicyUrl",
-      "cloudformation:TemplateUrl",
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "cloudformation:TemplateUrl"
     ],
     "dependentActions": []
   },
@@ -1311,11 +1306,11 @@
       }
     ],
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cloudformation:RoleArn",
-      "cloudformation:TemplateUrl",
       "cloudformation:TargetRegion",
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "cloudformation:TemplateUrl"
     ],
     "dependentActions": []
   },

package/data/actions/cloudfront.json

@@ -1,9 +1,8 @@
 {
   "allowvendedlogdeliveryforresource": {
     "name": "AllowVendedLogDeliveryForResource",
-    "isPermissionOnly": true,
     "description": "Grants permission to configure vended log delivery for a distribution",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "distribution",
@@ -15,6 +14,62 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createsavingsplan": {
+    "name": "CreateSavingsPlan",
+    "description": "Grants permission to create a new savings plan",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getsavingsplan": {
+    "name": "GetSavingsPlan",
+    "description": "Grants permission to get a savings plan",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdistributionsbylambdafunction": {
+    "name": "ListDistributionsByLambdaFunction",
+    "description": "Grants permission to list the distributions associated a Lambda function",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listratecards": {
+    "name": "ListRateCards",
+    "description": "Grants permission to list CloudFront rate cards for the account",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listsavingsplans": {
+    "name": "ListSavingsPlans",
+    "description": "Grants permission to list savings plans in the account",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listusages": {
+    "name": "ListUsages",
+    "description": "Grants permission to list CloudFront usage",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatesavingsplan": {
+    "name": "UpdateSavingsPlan",
+    "description": "Grants permission to update a savings plan",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "associatealias": {
     "name": "AssociateAlias",
     "description": "Grants permission to associate an alias to a CloudFront distribution",
@@ -73,11 +128,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "cloudfront:CopyDistribution",
-      "cloudfront:CreateDistribution",
-      "cloudfront:GetDistribution"
-    ]
+    "dependentActions": []
   },
   "createanycastiplist": {
     "name": "CreateAnycastIpList",
@@ -145,9 +196,7 @@
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys"
     ],
-    "dependentActions": [
-      "cloudfront:CreateConnectionGroup"
-    ]
+    "dependentActions": []
   },
   "createdistributiontenant": {
     "name": "CreateDistributionTenant",
@@ -284,15 +333,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "createsavingsplan": {
-    "name": "CreateSavingsPlan",
-    "isPermissionOnly": true,
-    "description": "Grants permission to create a new savings plan",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "createstreamingdistribution": {
     "name": "CreateStreamingDistribution",
     "description": "Grants permission to create a new RTMP distribution",
@@ -1223,15 +1263,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getsavingsplan": {
-    "name": "GetSavingsPlan",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get a savings plan",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "getstreamingdistribution": {
     "name": "GetStreamingDistribution",
     "description": "Grants permission to get the information about an RTMP distribution",
@@ -1426,15 +1457,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listdistributionsbylambdafunction": {
-    "name": "ListDistributionsByLambdaFunction",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list the distributions associated a Lambda function",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listdistributionsbyoriginrequestpolicyid": {
     "name": "ListDistributionsByOriginRequestPolicyId",
     "description": "Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy",
@@ -1605,15 +1627,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listratecards": {
-    "name": "ListRateCards",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list CloudFront rate cards for the account",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listrealtimelogconfigs": {
     "name": "ListRealtimeLogConfigs",
     "description": "Grants permission to get a list of real-time log configurations",
@@ -1630,15 +1643,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listsavingsplans": {
-    "name": "ListSavingsPlans",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list savings plans in the account",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "liststreamingdistributions": {
     "name": "ListStreamingDistributions",
     "description": "Grants permission to list your RTMP distributions",
@@ -1718,15 +1722,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listusages": {
-    "name": "ListUsages",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list CloudFront usage",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listvpcorigins": {
     "name": "ListVpcOrigins",
     "description": "Grants permission to list VPC origins",
@@ -1783,7 +1778,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add tags to a CloudFront resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "anycast-ip-list",
@@ -1885,7 +1880,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from a CloudFront resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "anycast-ip-list",
@@ -2238,15 +2233,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "updatesavingsplan": {
-    "name": "UpdateSavingsPlan",
-    "isPermissionOnly": true,
-    "description": "Grants permission to update a savings plan",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "updatestreamingdistribution": {
     "name": "UpdateStreamingDistribution",
     "description": "Grants permission to update the configuration for an RTMP distribution",

package/data/actions/cloudhsm.json

@@ -8,11 +8,7 @@
         "name": "backup",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "cloudhsm:CopyBackupToRegion",
-          "cloudhsm:TagResource",
-          "cloudhsm:UntagResource"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -30,16 +26,7 @@
         "name": "backup",
         "required": false,
         "conditionKeys": [],
-        "dependentActions": [
-          "cloudhsm:TagResource",
-          "ec2:AuthorizeSecurityGroupEgress",
-          "ec2:AuthorizeSecurityGroupIngress",
-          "ec2:CreateSecurityGroup",
-          "ec2:DescribeSecurityGroups",
-          "ec2:DescribeSubnets",
-          "ec2:RevokeSecurityGroupEgress",
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -61,17 +48,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "ec2:AuthorizeSecurityGroupEgress",
-      "ec2:AuthorizeSecurityGroupIngress",
-      "ec2:CreateNetworkInterface",
-      "ec2:CreateSecurityGroup",
-      "ec2:DeleteNetworkInterface",
-      "ec2:DescribeNetworkInterfaces",
-      "ec2:DescribeSecurityGroups",
-      "ec2:DescribeSubnets",
-      "ec2:RevokeSecurityGroupEgress"
-    ]
+    "dependentActions": []
   },
   "deletebackup": {
     "name": "DeleteBackup",
@@ -101,10 +78,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "ec2:DeleteNetworkInterface",
-      "ec2:DeleteSecurityGroup"
-    ]
+    "dependentActions": []
   },
   "deletehsm": {
     "name": "DeleteHsm",
@@ -112,14 +86,12 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "ec2:DeleteNetworkInterface"
-    ]
+    "dependentActions": []
   },
   "deleteresourcepolicy": {
     "name": "DeleteResourcePolicy",
     "description": "Grants permission to delete the policy attached to CloudHSM resources",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "backup",
@@ -226,14 +198,12 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "ec2:DescribeSubnets"
-    ]
+    "dependentActions": []
   },
   "putresourcepolicy": {
     "name": "PutResourcePolicy",
     "description": "Grants permission to attach a policy to an AWS CloudHSM resource",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "backup",
@@ -263,7 +233,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add or overwrite one or more tags for the specified AWS CloudHSM cluster",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "backup",
@@ -287,7 +257,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove the specified tag or tags from the specified AWS CloudHSM cluster",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "backup",

package/data/actions/cloudsearch.json

@@ -1,8 +1,53 @@
 {
+  "document": {
+    "name": "document",
+    "description": "Allows access to the document service operations",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "domain",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "search": {
+    "name": "search",
+    "description": "Allows access to the search operations",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domain",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "suggest": {
+    "name": "suggest",
+    "description": "Allows access to the suggest operations",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "domain",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "addtags": {
     "name": "AddTags",
     "description": "Attaches resource tags to an Amazon CloudSearch domain",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "domain",
@@ -362,7 +407,7 @@
   "removetags": {
     "name": "RemoveTags",
     "description": "Removes the specified resource tags from an Amazon ES domain",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "domain",
@@ -422,7 +467,7 @@
   "updateserviceaccesspolicies": {
     "name": "UpdateServiceAccessPolicies",
     "description": "Configures the access rules that control access to the domain's document and search endpoints",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "domain",
@@ -433,53 +478,5 @@
     ],
     "conditionKeys": [],
     "dependentActions": []
-  },
-  "document": {
-    "name": "document",
-    "isPermissionOnly": true,
-    "description": "Allows access to the document service operations",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "domain",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "search": {
-    "name": "search",
-    "isPermissionOnly": true,
-    "description": "Allows access to the search operations",
-    "accessLevel": "Read",
-    "resourceTypes": [
-      {
-        "name": "domain",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "suggest": {
-    "name": "suggest",
-    "isPermissionOnly": true,
-    "description": "Allows access to the suggest operations",
-    "accessLevel": "Read",
-    "resourceTypes": [
-      {
-        "name": "domain",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
   }
 }