@cloud-copilot/iam-data 0.19.202607031 → 0.19.202607151

package/data/actions/apptest.json

@@ -40,7 +40,9 @@
       {
         "name": "TestCase",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -55,7 +57,9 @@
       {
         "name": "TestConfiguration",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -70,15 +74,14 @@
       {
         "name": "TestRun",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "s3:DeleteObject",
-      "s3:ListBucket"
-    ]
+    "dependentActions": []
   },
   "deletetestsuite": {
     "name": "DeleteTestSuite",
@@ -88,7 +91,9 @@
       {
         "name": "TestSuite",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -103,7 +108,9 @@
       {
         "name": "TestCase",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -118,7 +125,9 @@
       {
         "name": "TestConfiguration",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -133,7 +142,9 @@
       {
         "name": "TestRun",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -148,7 +159,9 @@
       {
         "name": "TestSuite",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -187,7 +200,9 @@
       {
         "name": "TestRun",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -202,7 +217,9 @@
       {
         "name": "TestRun",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -234,101 +251,100 @@
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys"
     ],
-    "dependentActions": [
-      "cloudformation:CreateStack",
-      "cloudformation:DeleteStack",
-      "cloudformation:DescribeStacks",
-      "dms:DescribeReplicationTasks",
-      "dms:StartReplicationTask",
-      "dms:StopReplicationTask",
-      "ec2:DescribeAvailabilityZones",
-      "ec2:DescribeVpcEndpointServiceConfigurations",
-      "ec2:DescribeVpcEndpointServices",
-      "m2:CreateDataSetImportTask",
-      "m2:GetApplication",
-      "m2:GetApplicationVersion",
-      "m2:GetBatchJobExecution",
-      "m2:GetDataSetDetails",
-      "m2:GetDataSetImportTask",
-      "m2:StartApplication",
-      "m2:StartBatchJob",
-      "m2:StopApplication",
-      "s3:CreateBucket",
-      "s3:DeleteObject",
-      "s3:GetObject",
-      "s3:ListBucket",
-      "s3:PutObject"
-    ]
+    "dependentActions": []
   },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "TestCase",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestConfiguration",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestRun",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestSuite",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to untag a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "TestCase",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestConfiguration",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestRun",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "TestSuite",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "updatetestcase": {
@@ -339,7 +355,9 @@
       {
         "name": "TestCase",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -354,7 +372,9 @@
       {
         "name": "TestConfiguration",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -369,7 +389,9 @@
       {
         "name": "TestSuite",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],

package/data/actions/aps.json

@@ -112,13 +112,7 @@
         "name": "cluster",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "aps:TagResource",
-          "ec2:DescribeSecurityGroups",
-          "ec2:DescribeSubnets",
-          "eks:DescribeCluster",
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       },
       {
         "name": "workspace",
@@ -765,8 +759,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -923,7 +917,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag an AMP resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "anomalydetector",
@@ -951,15 +945,15 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to untag an AMP resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "anomalydetector",
@@ -1034,10 +1028,7 @@
         "name": "scraper",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "aps:CreateScraper",
-          "aps:TagResource"
-        ]
+        "dependentActions": []
       },
       {
         "name": "workspace",

package/data/actions/arc-region-switch.json

@@ -1,4 +1,35 @@
 {
+  "deleteresourcepolicy": {
+    "name": "DeleteResourcePolicy",
+    "description": "Grants permission to delete the RAM access control policy for a plan",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getresourcepolicy": {
+    "name": "GetResourcePolicy",
+    "description": "Grants permission to get the resource policy of a plan",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [
+      {
+        "name": "plan",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putresourcepolicy": {
+    "name": "PutResourcePolicy",
+    "description": "Grants permission to define the RAM access control policy for a plan",
+    "accessLevel": "Permissions management, Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "approveplanexecutionstep": {
     "name": "ApprovePlanExecutionStep",
     "description": "Grants permission to approve a plan execution step",
@@ -62,15 +93,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "deleteresourcepolicy": {
-    "name": "DeleteResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to delete the RAM access control policy for a plan",
-    "accessLevel": "Permissions management",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "getplan": {
     "name": "GetPlan",
     "description": "Grants permission to get information about plans in all AWS Regions using a control plane",
@@ -131,22 +153,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getresourcepolicy": {
-    "name": "GetResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get the resource policy of a plan",
-    "accessLevel": "Permissions management",
-    "resourceTypes": [
-      {
-        "name": "plan",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listplanexecutionevents": {
     "name": "ListPlanExecutionEvents",
     "description": "Grants permission to list plan execution events",
@@ -240,15 +246,6 @@
     ],
     "dependentActions": []
   },
-  "putresourcepolicy": {
-    "name": "PutResourcePolicy",
-    "isPermissionOnly": true,
-    "description": "Grants permission to define the RAM access control policy for a plan",
-    "accessLevel": "Permissions management",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "startplanexecution": {
     "name": "StartPlanExecution",
     "description": "Grants permission to start a plan execution",
@@ -267,7 +264,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "plan",
@@ -286,7 +283,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "plan",

package/data/actions/arc-zonal-shift.json

@@ -58,10 +58,7 @@
         "name": "ALB",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "cloudwatch:DescribeAlarms",
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       },
       {
         "name": "NLB",
@@ -226,10 +223,7 @@
         "name": "ALB",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "cloudwatch:DescribeAlarms",
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       },
       {
         "name": "NLB",
@@ -254,9 +248,7 @@
         "name": "ALB",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       },
       {
         "name": "NLB",

package/data/actions/arsenal.json

@@ -1,7 +1,6 @@
 {
   "registeronpremisesagent": {
     "name": "RegisterOnPremisesAgent",
-    "isPermissionOnly": true,
     "description": "Grants permission to register AWS provided data collectors to the Application Discovery Service",
     "accessLevel": "Write",
     "resourceTypes": [],

package/data/actions/artifact.json

@@ -256,7 +256,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to associate a set of tags with an AWS Artifact resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "compliance-inquiry",
@@ -289,7 +289,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove the association of tags from an AWS Artifact resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "compliance-inquiry",

package/data/actions/athena.json

@@ -557,14 +557,14 @@
     "accessLevel": "Read",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -578,14 +578,14 @@
     "accessLevel": "Read",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -599,14 +599,14 @@
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -620,14 +620,14 @@
     "accessLevel": "Read",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -977,14 +977,14 @@
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1028,7 +1028,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add a tag to a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "capacity-reservation",
@@ -1067,14 +1067,14 @@
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "workgroup",
-        "required": true,
+        "name": "session",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
-        "name": "session",
-        "required": false,
+        "name": "workgroup",
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1085,7 +1085,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove a tag from a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "capacity-reservation",