@cloud-copilot/iam-data 0.19.202607031 → 0.20.202607151

package/data/actions/states.json

@@ -1,4 +1,20 @@
 {
+  "invokehttpendpoint": {
+    "name": "InvokeHTTPEndpoint",
+    "description": "Grants permission to invoke the HTTP Task state",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "revealsecrets": {
+    "name": "RevealSecrets",
+    "description": "Grants permission to reveal sensitive data from an execution",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createactivity": {
     "name": "CreateActivity",
     "description": "Grants permission to create an activity",
@@ -26,10 +42,7 @@
         "name": "statemachine",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:PassRole",
-          "states:PublishStateMachineVersion"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -249,15 +262,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "invokehttpendpoint": {
-    "name": "InvokeHTTPEndpoint",
-    "isPermissionOnly": true,
-    "description": "Grants permission to invoke the HTTP Task state",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listactivities": {
     "name": "ListActivities",
     "description": "Grants permission to list the existing activities",
@@ -395,15 +399,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "revealsecrets": {
-    "name": "RevealSecrets",
-    "isPermissionOnly": true,
-    "description": "Grants permission to reveal sensitive data from an execution",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "sendtaskfailure": {
     "name": "SendTaskFailure",
     "description": "Grants permission to report that the task identified by the taskToken failed",
@@ -480,7 +475,7 @@
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to tag an AWS Step Functions resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "activity",
@@ -496,8 +491,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -507,14 +502,12 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "states:RevealSecrets"
-    ]
+    "dependentActions": []
   },
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove a tag from an AWS Step Functions resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "activity",
@@ -558,10 +551,7 @@
         "name": "statemachine",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "iam:PassRole",
-          "states:PublishStateMachineVersion"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [

package/data/actions/storagegateway.json

@@ -28,7 +28,7 @@
   "addtagstoresource": {
     "name": "AddTagsToResource",
     "description": "Grants permission to add one or more tags to the specified resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "cache-report",
@@ -139,16 +139,7 @@
         "name": "gateway",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": [
-          "ds:DescribeDirectories",
-          "ec2:DescribeNetworkInterfaces",
-          "fsx:DescribeFileSystems",
-          "iam:CreateServiceLinkedRole",
-          "logs:CreateLogDelivery",
-          "logs:GetLogDelivery",
-          "logs:ListLogDeliveries",
-          "logs:UpdateLogDelivery"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -1145,7 +1136,7 @@
   "removetagsfromresource": {
     "name": "RemoveTagsFromResource",
     "description": "Grants permission to remove one or more tags from the specified resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "cache-report",
@@ -1424,13 +1415,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "logs:CreateLogDelivery",
-      "logs:DeleteLogDelivery",
-      "logs:GetLogDelivery",
-      "logs:ListLogDeliveries",
-      "logs:UpdateLogDelivery"
-    ]
+    "dependentActions": []
   },
   "updategatewayinformation": {
     "name": "UpdateGatewayInformation",

package/data/actions/sts.json

@@ -1,4 +1,87 @@
 {
+  "getservicebearertoken": {
+    "name": "GetServiceBearerToken",
+    "description": "Grants permission to obtain a STS bearer token for an AWS root user, IAM role, or an IAM user",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "sts:AWSServiceName",
+      "sts:DurationSeconds"
+    ],
+    "dependentActions": []
+  },
+  "setcontext": {
+    "name": "SetContext",
+    "description": "Grants permission to set context keys on a STS session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "role",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "self-session",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "sts:RequestContext/${ContextKey}",
+      "sts:RequestContextProviders"
+    ],
+    "dependentActions": []
+  },
+  "setsourceidentity": {
+    "name": "SetSourceIdentity",
+    "description": "Grants permission to set a source identity on a STS session",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "role",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "sts:SourceIdentity"
+    ],
+    "dependentActions": []
+  },
+  "taggetwebidentitytoken": {
+    "name": "TagGetWebIdentityToken",
+    "description": "Grants permission to add tags to the JSON Web Token (JWT) generated by the GetWebIdentityToken API",
+    "accessLevel": "Tagging, Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "tagsession": {
+    "name": "TagSession",
+    "description": "Grants permission to add tags to a STS session",
+    "accessLevel": "Tagging, Write",
+    "resourceTypes": [
+      {
+        "name": "role",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "saml:aud",
+      "sts:TransitiveTagKeys"
+    ],
+    "dependentActions": []
+  },
   "assumerole": {
     "name": "AssumeRole",
     "description": "Grants permission to obtain a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to",
@@ -12,25 +95,25 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
+      "accounts.google.com:aud",
+      "accounts.google.com:sub",
       "aws:RequestTag/${TagKey}",
-      "sts:TransitiveTagKeys",
-      "sts:ExternalId",
-      "sts:RoleSessionName",
-      "iam:ResourceTag/${TagKey}",
-      "sts:SourceIdentity",
+      "aws:TagKeys",
       "cognito-identity.amazonaws.com:amr",
       "cognito-identity.amazonaws.com:aud",
       "cognito-identity.amazonaws.com:sub",
-      "www.amazon.com:app_id",
-      "www.amazon.com:user_id",
       "graph.facebook.com:app_id",
       "graph.facebook.com:id",
-      "accounts.google.com:aud",
-      "accounts.google.com:sub",
+      "iam:ResourceTag/${TagKey}",
       "saml:namequalifier",
       "saml:sub",
-      "saml:sub_type"
+      "saml:sub_type",
+      "sts:ExternalId",
+      "sts:RoleSessionName",
+      "sts:SourceIdentity",
+      "sts:TransitiveTagKeys",
+      "www.amazon.com:app_id",
+      "www.amazon.com:user_id"
     ],
     "dependentActions": []
   },
@@ -47,14 +130,12 @@
       }
     ],
     "conditionKeys": [
-      "saml:namequalifier",
-      "saml:sub",
-      "saml:sub_type",
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "saml:aud",
-      "saml:iss",
-      "saml:doc",
       "saml:cn",
       "saml:commonName",
+      "saml:doc",
       "saml:eduorghomepageuri",
       "saml:eduorgidentityauthnpolicyuri",
       "saml:eduorglegalname",
@@ -72,18 +153,20 @@
       "saml:edupersonscopedaffiliation",
       "saml:edupersontargetedid",
       "saml:givenName",
+      "saml:iss",
       "saml:mail",
       "saml:name",
+      "saml:namequalifier",
       "saml:organizationStatus",
       "saml:primaryGroupSID",
+      "saml:sub",
+      "saml:sub_type",
       "saml:surname",
       "saml:uid",
       "saml:x500UniqueIdentifier",
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}",
-      "sts:TransitiveTagKeys",
+      "sts:RoleSessionName",
       "sts:SourceIdentity",
-      "sts:RoleSessionName"
+      "sts:TransitiveTagKeys"
     ],
     "dependentActions": []
   },
@@ -100,21 +183,95 @@
       }
     ],
     "conditionKeys": [
+      "accounts.google.com:aud",
+      "accounts.google.com:google/organization_number",
+      "accounts.google.com:oaud",
+      "accounts.google.com:sub",
+      "agent.${Domain}.buildkite.dev:build_branch",
+      "agent.${Domain}.buildkite.dev:cluster_id",
+      "agent.${Domain}.buildkite.dev:cluster_name",
+      "agent.${Domain}.buildkite.dev:organization_id",
+      "agent.${Domain}.buildkite.dev:organization_slug",
+      "agent.${Domain}.buildkite.dev:pipeline_id",
+      "agent.${Domain}.buildkite.dev:pipeline_slug",
+      "agent.${Domain}.buildkite.site:build_branch",
+      "agent.${Domain}.buildkite.site:cluster_id",
+      "agent.${Domain}.buildkite.site:cluster_name",
+      "agent.${Domain}.buildkite.site:organization_id",
+      "agent.${Domain}.buildkite.site:organization_slug",
+      "agent.${Domain}.buildkite.site:pipeline_id",
+      "agent.${Domain}.buildkite.site:pipeline_slug",
+      "agent.buildkite.com:build_branch",
+      "agent.buildkite.com:cluster_id",
+      "agent.buildkite.com:cluster_name",
+      "agent.buildkite.com:organization_id",
+      "agent.buildkite.com:organization_slug",
+      "agent.buildkite.com:pipeline_id",
+      "agent.buildkite.com:pipeline_slug",
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "cognito-identity.amazonaws.com:amr",
       "cognito-identity.amazonaws.com:aud",
       "cognito-identity.amazonaws.com:sub",
-      "www.amazon.com:app_id",
-      "www.amazon.com:user_id",
+      "github.com/enterprises/${EnterpriseName}:actor",
+      "github.com/enterprises/${EnterpriseName}:actor_id",
+      "github.com/enterprises/${EnterpriseName}:enterprise_id",
+      "github.com/enterprises/${EnterpriseName}:environment",
+      "github.com/enterprises/${EnterpriseName}:job_workflow_ref",
+      "github.com/enterprises/${EnterpriseName}:ref",
+      "github.com/enterprises/${EnterpriseName}:repository",
+      "github.com/enterprises/${EnterpriseName}:repository_id",
+      "github.com/enterprises/${EnterpriseName}:repository_owner_id",
+      "github.com/enterprises/${EnterpriseName}:workflow",
+      "gitlab.com:namespace_id",
+      "gitlab.com:pipeline_source",
+      "gitlab.com:project_id",
+      "gitlab.com:ref_protected",
+      "gitlab.com:runner_environment",
+      "gitlab.com:user_access_level",
+      "gitlab.com:user_email",
+      "gitlab.com:user_id",
+      "gitlab.com:user_login",
       "graph.facebook.com:app_id",
       "graph.facebook.com:id",
-      "accounts.google.com:aud",
-      "accounts.google.com:oaud",
-      "accounts.google.com:sub",
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}",
-      "sts:TransitiveTagKeys",
+      "idcs-${OciUniqueIdentifier}.identity.oraclecloud.com:rpst_id",
+      "oidc.circleci.com/org/${OrgId}:oidc.circleci.com/project-id",
+      "sts:RoleAuthorizedByIdp",
+      "sts:RoleSessionName",
       "sts:SourceIdentity",
-      "sts:RoleSessionName"
+      "sts:TransitiveTagKeys",
+      "token.actions.${Domain}.ghe.com:actor",
+      "token.actions.${Domain}.ghe.com:actor_id",
+      "token.actions.${Domain}.ghe.com:enterprise_id",
+      "token.actions.${Domain}.ghe.com:environment",
+      "token.actions.${Domain}.ghe.com:job_workflow_ref",
+      "token.actions.${Domain}.ghe.com:ref",
+      "token.actions.${Domain}.ghe.com:repository",
+      "token.actions.${Domain}.ghe.com:repository_id",
+      "token.actions.${Domain}.ghe.com:repository_owner_id",
+      "token.actions.${Domain}.ghe.com:workflow",
+      "token.actions.githubusercontent.com/${SubPath}:actor",
+      "token.actions.githubusercontent.com/${SubPath}:actor_id",
+      "token.actions.githubusercontent.com/${SubPath}:enterprise_id",
+      "token.actions.githubusercontent.com/${SubPath}:environment",
+      "token.actions.githubusercontent.com/${SubPath}:job_workflow_ref",
+      "token.actions.githubusercontent.com/${SubPath}:ref",
+      "token.actions.githubusercontent.com/${SubPath}:repository",
+      "token.actions.githubusercontent.com/${SubPath}:repository_id",
+      "token.actions.githubusercontent.com/${SubPath}:repository_owner_id",
+      "token.actions.githubusercontent.com/${SubPath}:workflow",
+      "token.actions.githubusercontent.com:actor",
+      "token.actions.githubusercontent.com:actor_id",
+      "token.actions.githubusercontent.com:enterprise_id",
+      "token.actions.githubusercontent.com:environment",
+      "token.actions.githubusercontent.com:job_workflow_ref",
+      "token.actions.githubusercontent.com:ref",
+      "token.actions.githubusercontent.com:repository",
+      "token.actions.githubusercontent.com:repository_id",
+      "token.actions.githubusercontent.com:repository_owner_id",
+      "token.actions.githubusercontent.com:workflow",
+      "www.amazon.com:app_id",
+      "www.amazon.com:user_id"
     ],
     "dependentActions": []
   },
@@ -180,20 +337,8 @@
       }
     ],
     "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
-    ],
-    "dependentActions": []
-  },
-  "getservicebearertoken": {
-    "name": "GetServiceBearerToken",
-    "isPermissionOnly": true,
-    "description": "Grants permission to obtain a STS bearer token for an AWS root user, IAM role, or an IAM user",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [
-      "sts:AWSServiceName",
-      "sts:DurationSeconds"
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -211,87 +356,11 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
       "sts:DurationSeconds",
       "sts:IdentityTokenAudience",
-      "sts:SigningAlgorithm",
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
-    ],
-    "dependentActions": []
-  },
-  "setcontext": {
-    "name": "SetContext",
-    "isPermissionOnly": true,
-    "description": "Grants permission to set context keys on a STS session",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "role",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "self-session",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [
-      "sts:RequestContext/${ContextKey}",
-      "sts:RequestContextProviders"
-    ],
-    "dependentActions": []
-  },
-  "setsourceidentity": {
-    "name": "SetSourceIdentity",
-    "isPermissionOnly": true,
-    "description": "Grants permission to set a source identity on a STS session",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "role",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [
-      "sts:SourceIdentity"
-    ],
-    "dependentActions": []
-  },
-  "taggetwebidentitytoken": {
-    "name": "TagGetWebIdentityToken",
-    "isPermissionOnly": true,
-    "description": "Grants permission to add tags to the JSON Web Token (JWT) generated by the GetWebIdentityToken API",
-    "accessLevel": "Tagging",
-    "resourceTypes": [],
-    "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}"
-    ],
-    "dependentActions": []
-  },
-  "tagsession": {
-    "name": "TagSession",
-    "isPermissionOnly": true,
-    "description": "Grants permission to add tags to a STS session",
-    "accessLevel": "Tagging",
-    "resourceTypes": [
-      {
-        "name": "role",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [
-      "aws:TagKeys",
-      "aws:RequestTag/${TagKey}",
-      "sts:TransitiveTagKeys",
-      "saml:aud"
+      "sts:SigningAlgorithm"
     ],
     "dependentActions": []
   }

package/data/actions/support-console.json

@@ -1,7 +1,6 @@
 {
   "checksubscription": {
     "name": "CheckSubscription",
-    "isPermissionOnly": true,
     "description": "Grants permission to check whether the account has access to given product",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -10,7 +9,6 @@
   },
   "createcasedraft": {
     "name": "CreateCaseDraft",
-    "isPermissionOnly": true,
     "description": "Grants permission to create or update case draft for the given case type",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -19,7 +17,6 @@
   },
   "createcontact": {
     "name": "CreateContact",
-    "isPermissionOnly": true,
     "description": "Grants permission to create an authenticated contact for the given contact type",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -28,7 +25,6 @@
   },
   "deletecasedraft": {
     "name": "DeleteCaseDraft",
-    "isPermissionOnly": true,
     "description": "Grants permission to delete a case draft for the given case type",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -37,7 +33,6 @@
   },
   "describedynamichelp": {
     "name": "DescribeDynamicHelp",
-    "isPermissionOnly": true,
     "description": "Grants permission to get dynamic help resources for given service and category",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -46,7 +41,6 @@
   },
   "getaccountgovcloudenabled": {
     "name": "GetAccountGovCloudEnabled",
-    "isPermissionOnly": true,
     "description": "Grants permission to determines whether the calling account is GovCloud enabled",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -55,7 +49,6 @@
   },
   "getaccountstate": {
     "name": "GetAccountState",
-    "isPermissionOnly": true,
     "description": "Grants permission to get the state of the calling account",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -64,7 +57,6 @@
   },
   "getbanner": {
     "name": "GetBanner",
-    "isPermissionOnly": true,
     "description": "Grants permission to get the support banner information",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -73,7 +65,6 @@
   },
   "getcasedraft": {
     "name": "GetCaseDraft",
-    "isPermissionOnly": true,
     "description": "Grants permission to get a case draft for given case type",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -82,7 +73,6 @@
   },
   "getissueclassificationpredictions": {
     "name": "GetIssueClassificationPredictions",
-    "isPermissionOnly": true,
     "description": "Grants permission to get classification predictions of an issue",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -91,7 +81,6 @@
   },
   "getissuetextsummary": {
     "name": "GetIssueTextSummary",
-    "isPermissionOnly": true,
     "description": "Grants permission to get a generated text summary of an issue",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -100,7 +89,6 @@
   },
   "getquestionnaire": {
     "name": "GetQuestionnaire",
-    "isPermissionOnly": true,
     "description": "Grants permission to get a feedback questionnaire",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -109,7 +97,6 @@
   },
   "savefeedback": {
     "name": "SaveFeedback",
-    "isPermissionOnly": true,
     "description": "Grants permission to save questionnaire feedback",
     "accessLevel": "Write",
     "resourceTypes": [],

package/data/actions/support.json

@@ -253,9 +253,7 @@
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "support:DescribeSupportLevel"
-    ]
+    "dependentActions": []
   },
   "updatecaseseverity": {
     "name": "UpdateCaseSeverity",