@cloud-copilot/iam-data 0.19.202607031 → 0.20.202607151

package/README.md

@@ -36,6 +36,14 @@ for(const serviceKey of serviceKeys) {
 * `iamServiceName(serviceKey: string)` - Returns the service name for a given service key.
 * `iamServiceExists(serviceKey: string)` - Returns true if the service key exists.
 
+### Categories
+* `serviceCategories()` - Returns an array of all service category keys such as 'storage', 'compute', etc.
+* `serviceCategoryExists(category: string)` - Returns true if the service category exists.
+* `iamServiceCategoryMap()` - Returns a map of IAM service keys to category keys.
+* `iamServicesForCategory(category: string)` - Returns an array of IAM service keys assigned to a category.
+* `categoryForIamService(service: string)` - Returns the category key for an IAM service key.
+* `getServiceCategory(category: string)` - Returns category details including `key`, `name`, and `services`.
+
 ### Actions
 * `iamActionsForService(serviceKey: string)` - Returns an array of all actions for a given service key.
 * `iamActionDetails(serviceKey: string, actionKey: string)` - Returns an object with the action details such as `description`, `resourceTypes`, and `conditionKeys`.

package/data/actions/a4b.json

@@ -1,4 +1,28 @@
 {
+  "completeregistration": {
+    "name": "CompleteRegistration",
+    "description": "Grants permission to complete the operation of registering an Alexa device",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putdevicesetupevents": {
+    "name": "PutDeviceSetupEvents",
+    "description": "Grants permission to publish Alexa device setup events",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "registerdevice": {
+    "name": "RegisterDevice",
+    "description": "Grants permission to register an Alexa device",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "approveskill": {
     "name": "ApproveSkill",
     "description": "Grants permission to associate a skill with the organization under the customer's AWS account",
@@ -36,7 +60,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
@@ -57,13 +83,17 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -78,7 +108,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
@@ -114,15 +146,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "completeregistration": {
-    "name": "CompleteRegistration",
-    "isPermissionOnly": true,
-    "description": "Grants permission to complete the operation of registering an Alexa device",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "createaddressbook": {
     "name": "CreateAddressBook",
     "description": "Grants permission to create an address book with the specified details",
@@ -208,14 +231,14 @@
       {
         "name": "profile",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "createskillgroup": {
@@ -237,14 +260,15 @@
       {
         "name": "user",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "deleteaddressbook": {
@@ -315,7 +339,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -330,7 +356,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -390,7 +418,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -405,7 +435,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -420,7 +452,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -450,7 +484,9 @@
       {
         "name": "user",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -486,7 +522,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -516,7 +554,9 @@
       {
         "name": "user",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -531,7 +571,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
@@ -552,7 +594,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -620,7 +664,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -703,7 +749,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -718,7 +766,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -764,7 +814,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -826,7 +878,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -841,19 +895,25 @@
       {
         "name": "device",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "room",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "user",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -868,15 +928,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "putdevicesetupevents": {
-    "name": "PutDeviceSetupEvents",
-    "isPermissionOnly": true,
-    "description": "Grants permission to publish Alexa device setup events",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "putinvitationconfiguration": {
     "name": "PutInvitationConfiguration",
     "description": "Grants permission to configure the email template for the user enrollment invitation with the specified attributes",
@@ -893,7 +944,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -908,7 +961,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -926,15 +981,6 @@
     ],
     "dependentActions": []
   },
-  "registerdevice": {
-    "name": "RegisterDevice",
-    "isPermissionOnly": true,
-    "description": "Grants permission to register an Alexa device",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "rejectskill": {
     "name": "RejectSkill",
     "description": "Grants permission to disassociate a skill from the organization under a user's AWS account",
@@ -959,7 +1005,9 @@
       {
         "name": "user",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -1046,7 +1094,9 @@
       {
         "name": "user",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -1069,7 +1119,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -1079,54 +1131,69 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add metadata tags to a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "device",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "room",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       },
       {
         "name": "user",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove metadata tags from a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "device",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "room",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       },
       {
         "name": "user",
         "required": false,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -1201,7 +1268,9 @@
       {
         "name": "device",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],
@@ -1276,7 +1345,9 @@
       {
         "name": "room",
         "required": true,
-        "conditionKeys": [],
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
         "dependentActions": []
       }
     ],

package/data/actions/access-analyzer.json

@@ -70,9 +70,7 @@
         "name": "Analyzer",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -105,9 +103,7 @@
         "name": "Analyzer",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:CreateServiceLinkedRole"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -410,9 +406,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "iam:PassRole"
-    ]
+    "dependentActions": []
   },
   "startresourcescan": {
     "name": "StartResourceScan",
@@ -432,7 +426,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add a tag to a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Analyzer",
@@ -450,7 +444,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove a tag from a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "Analyzer",

package/data/actions/account.json

@@ -1,35 +1,34 @@
 {
-  "acceptprimaryemailupdate": {
-    "name": "AcceptPrimaryEmailUpdate",
-    "description": "Grants permission to accept the process to update the primary email address of an account",
+  "closeaccount": {
+    "name": "CloseAccount",
+    "description": "Grants permission to close an account",
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "accountInOrganization",
+        "name": "account",
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [
-      "account:EmailTargetDomain"
-    ],
+    "conditionKeys": [],
     "dependentActions": []
   },
-  "closeaccount": {
-    "name": "CloseAccount",
-    "isPermissionOnly": true,
-    "description": "Grants permission to close an account",
+  "acceptprimaryemailupdate": {
+    "name": "AcceptPrimaryEmailUpdate",
+    "description": "Grants permission to accept the process to update the primary email address of an account",
     "accessLevel": "Write",
     "resourceTypes": [
       {
-        "name": "account",
+        "name": "accountInOrganization",
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "account:EmailTargetDomain"
+    ],
     "dependentActions": []
   },
   "deletealternatecontact": {

package/data/actions/acm-pca.json

@@ -29,7 +29,7 @@
   "createpermission": {
     "name": "CreatePermission",
     "description": "Grants permission to create a permission for an AWS Private CA",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",
@@ -59,7 +59,7 @@
   "deletepermission": {
     "name": "DeletePermission",
     "description": "Grants permission to delete a permission for an AWS Private CA",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",
@@ -74,7 +74,7 @@
   "deletepolicy": {
     "name": "DeletePolicy",
     "description": "Grants permission to delete the policy for an AWS Private CA",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",
@@ -249,7 +249,7 @@
   "putpolicy": {
     "name": "PutPolicy",
     "description": "Grants permission to put a policy on an AWS Private CA",
-    "accessLevel": "Permissions management",
+    "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",
@@ -294,7 +294,7 @@
   "tagcertificateauthority": {
     "name": "TagCertificateAuthority",
     "description": "Grants permission to add one or more tags to an AWS Private CA",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",
@@ -304,15 +304,15 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
   "untagcertificateauthority": {
     "name": "UntagCertificateAuthority",
     "description": "Grants permission to remove one or more tags from an AWS Private CA",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "certificate-authority",