@cloud-copilot/iam-data 0.19.202607031 → 0.20.202607151

package/data/actions/consolidatedbilling.json

@@ -1,7 +1,6 @@
 {
   "getaccountbillingrole": {
     "name": "GetAccountBillingRole",
-    "isPermissionOnly": true,
     "description": "Grants permission to get account role (Payer, Linked, Regular)",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -10,7 +9,6 @@
   },
   "listlinkedaccounts": {
     "name": "ListLinkedAccounts",
-    "isPermissionOnly": true,
     "description": "Grants permission to get list of member/linked accounts",
     "accessLevel": "List",
     "resourceTypes": [],

package/data/actions/controltower.json

@@ -1,44 +1,14 @@
 {
-  "createlandingzone": {
-    "name": "CreateLandingZone",
-    "description": "Grants permission to create a landing zone",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
-    "dependentActions": [
-      "controltower:TagResource"
-    ]
-  },
   "createmanagedaccount": {
     "name": "CreateManagedAccount",
-    "isPermissionOnly": true,
     "description": "Grants permission to create an account managed by AWS Control Tower",
     "accessLevel": "Write",
     "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
-  "deletelandingzone": {
-    "name": "DeleteLandingZone",
-    "description": "Grants permission to delete AWS Control Tower landing zone",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "LandingZone",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "deregistermanagedaccount": {
     "name": "DeregisterManagedAccount",
-    "isPermissionOnly": true,
     "description": "Grants permission to deregister an account created through the account factory from AWS Control Tower",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -47,7 +17,6 @@
   },
   "deregisterorganizationalunit": {
     "name": "DeregisterOrganizationalUnit",
-    "isPermissionOnly": true,
     "description": "Grants permission to deregister an organizational unit from AWS Control Tower management",
     "accessLevel": "Write",
     "resourceTypes": [],
@@ -56,7 +25,6 @@
   },
   "describeaccountfactoryconfig": {
     "name": "DescribeAccountFactoryConfig",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe the current account factory configuration",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -65,7 +33,6 @@
   },
   "describecoreservice": {
     "name": "DescribeCoreService",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe resources managed by core accounts in AWS Control Tower",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -74,7 +41,6 @@
   },
   "describeguardrail": {
     "name": "DescribeGuardrail",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe a guardrail",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -83,7 +49,6 @@
   },
   "describeguardrailfortarget": {
     "name": "DescribeGuardrailForTarget",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe a guardrail for a organizational unit",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -92,7 +57,6 @@
   },
   "describelandingzoneconfiguration": {
     "name": "DescribeLandingZoneConfiguration",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe the current Landing Zone configuration",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -101,7 +65,6 @@
   },
   "describemanagedaccount": {
     "name": "DescribeManagedAccount",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe an account created through account factory",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -110,7 +73,6 @@
   },
   "describemanagedorganizationalunit": {
     "name": "DescribeManagedOrganizationalUnit",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe an AWS Organizations organizational unit managed by AWS Control Tower",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -119,7 +81,6 @@
   },
   "describeregisterorganizationalunitoperation": {
     "name": "DescribeRegisterOrganizationalUnitOperation",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe a Register Organizational Unit Operation",
     "accessLevel": "Read",
     "resourceTypes": [],
@@ -128,13 +89,214 @@
   },
   "describesinglesignon": {
     "name": "DescribeSingleSignOn",
-    "isPermissionOnly": true,
     "description": "Grants permission to describe the current AWS Control Tower IAM Identity Center configuration",
     "accessLevel": "Read",
     "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
+  "disableguardrail": {
+    "name": "DisableGuardrail",
+    "description": "Grants permission to disable a guardrail from an organizational unit",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "enableguardrail": {
+    "name": "EnableGuardrail",
+    "description": "Grants permission to enable a guardrail to an organizational unit",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getaccountinfo": {
+    "name": "GetAccountInfo",
+    "description": "Grants permission to describe an account email and validate that it exists",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getavailableupdates": {
+    "name": "GetAvailableUpdates",
+    "description": "Grants permission to list available updates for the current AWS Control Tower deployment",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getguardrailcompliancestatus": {
+    "name": "GetGuardrailComplianceStatus",
+    "description": "Grants permission to get the current compliance status of a guardrail",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "gethomeregion": {
+    "name": "GetHomeRegion",
+    "description": "Grants permission to get the home region of the AWS Control Tower setup",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getlandingzonestatus": {
+    "name": "GetLandingZoneStatus",
+    "description": "Grants permission to get the current status of the landing zone setup",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdirectorygroups": {
+    "name": "ListDirectoryGroups",
+    "description": "Grants permission to list the current directory groups available through IAM Identity Center",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listenabledguardrails": {
+    "name": "ListEnabledGuardrails",
+    "description": "Grants permission to list currently enabled guardrails",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listextendgovernanceprecheckdetails": {
+    "name": "ListExtendGovernancePrecheckDetails",
+    "description": "Grants permission to list Precheck details for an Organizational Unit",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listguardrailviolations": {
+    "name": "ListGuardrailViolations",
+    "description": "Grants permission to list existing guardrail violations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listguardrails": {
+    "name": "ListGuardrails",
+    "description": "Grants permission to list all available guardrails",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listguardrailsfortarget": {
+    "name": "ListGuardrailsForTarget",
+    "description": "Grants permission to list guardrails and their current state for a organizational unit",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmanagedaccounts": {
+    "name": "ListManagedAccounts",
+    "description": "Grants permission to list accounts managed through AWS Control Tower",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmanagedaccountsforguardrail": {
+    "name": "ListManagedAccountsForGuardrail",
+    "description": "Grants permission to list managed accounts with a specified guardrail applied",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmanagedaccountsforparent": {
+    "name": "ListManagedAccountsForParent",
+    "description": "Grants permission to list managed accounts under an organizational unit",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmanagedorganizationalunits": {
+    "name": "ListManagedOrganizationalUnits",
+    "description": "Grants permission to list organizational units managed by AWS Control Tower",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listmanagedorganizationalunitsforguardrail": {
+    "name": "ListManagedOrganizationalUnitsForGuardrail",
+    "description": "Grants permission to list managed organizational units that have a specified guardrail applied",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "manageorganizationalunit": {
+    "name": "ManageOrganizationalUnit",
+    "description": "Grants permission to set up an organizational unit to be managed by AWS Control Tower",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "performprelaunchchecks": {
+    "name": "PerformPreLaunchChecks",
+    "description": "Grants permission to perform validations in an account",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "setuplandingzone": {
+    "name": "SetupLandingZone",
+    "description": "Grants permission to set up or update AWS Control Tower landing zone",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updateaccountfactoryconfig": {
+    "name": "UpdateAccountFactoryConfig",
+    "description": "Grants permission to update the account factory configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createlandingzone": {
+    "name": "CreateLandingZone",
+    "description": "Grants permission to create a landing zone",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "deletelandingzone": {
+    "name": "DeleteLandingZone",
+    "description": "Grants permission to delete AWS Control Tower landing zone",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "LandingZone",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "disablebaseline": {
     "name": "DisableBaseline",
     "description": "Grants permission to disable a Baseline on a target",
@@ -165,15 +327,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "disableguardrail": {
-    "name": "DisableGuardrail",
-    "isPermissionOnly": true,
-    "description": "Grants permission to disable a guardrail from an organizational unit",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "enablebaseline": {
     "name": "EnableBaseline",
     "description": "Grants permission to enable a Baseline on a target",
@@ -183,9 +336,7 @@
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys"
     ],
-    "dependentActions": [
-      "controltower:TagResource"
-    ]
+    "dependentActions": []
   },
   "enablecontrol": {
     "name": "EnableControl",
@@ -196,9 +347,7 @@
         "name": "EnabledControl",
         "required": false,
         "conditionKeys": [],
-        "dependentActions": [
-          "controltower:TagResource"
-        ]
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -207,33 +356,6 @@
     ],
     "dependentActions": []
   },
-  "enableguardrail": {
-    "name": "EnableGuardrail",
-    "isPermissionOnly": true,
-    "description": "Grants permission to enable a guardrail to an organizational unit",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "getaccountinfo": {
-    "name": "GetAccountInfo",
-    "isPermissionOnly": true,
-    "description": "Grants permission to describe an account email and validate that it exists",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "getavailableupdates": {
-    "name": "GetAvailableUpdates",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list available updates for the current AWS Control Tower deployment",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "getbaseline": {
     "name": "GetBaseline",
     "description": "Grants permission to get Baseline details",
@@ -295,24 +417,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getguardrailcompliancestatus": {
-    "name": "GetGuardrailComplianceStatus",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get the current compliance status of a guardrail",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "gethomeregion": {
-    "name": "GetHomeRegion",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get the home region of the AWS Control Tower setup",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "getlandingzone": {
     "name": "GetLandingZone",
     "description": "Grants permission to get the current status of the landing zone setup",
@@ -344,15 +448,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "getlandingzonestatus": {
-    "name": "GetLandingZoneStatus",
-    "isPermissionOnly": true,
-    "description": "Grants permission to get the current status of the landing zone setup",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listbaselines": {
     "name": "ListBaselines",
     "description": "Grants permission to list Baselines",
@@ -369,15 +464,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listdirectorygroups": {
-    "name": "ListDirectoryGroups",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list the current directory groups available through IAM Identity Center",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listdriftdetails": {
     "name": "ListDriftDetails",
     "description": "Grants permission to list occurrences of drift in AWS Control Tower",
@@ -402,24 +488,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listenabledguardrails": {
-    "name": "ListEnabledGuardrails",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list currently enabled guardrails",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listextendgovernanceprecheckdetails": {
-    "name": "ListExtendGovernancePrecheckDetails",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list Precheck details for an Organizational Unit",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listexternalconfigrulecompliance": {
     "name": "ListExternalConfigRuleCompliance",
     "description": "Grants permission to list the compliance of external AWS Config rules",
@@ -428,33 +496,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listguardrailviolations": {
-    "name": "ListGuardrailViolations",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list existing guardrail violations",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listguardrails": {
-    "name": "ListGuardrails",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list all available guardrails",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listguardrailsfortarget": {
-    "name": "ListGuardrailsForTarget",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list guardrails and their current state for a organizational unit",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listlandingzoneoperations": {
     "name": "ListLandingZoneOperations",
     "description": "Grants permission to list all landing zone operations",
@@ -471,51 +512,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listmanagedaccounts": {
-    "name": "ListManagedAccounts",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list accounts managed through AWS Control Tower",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listmanagedaccountsforguardrail": {
-    "name": "ListManagedAccountsForGuardrail",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list managed accounts with a specified guardrail applied",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listmanagedaccountsforparent": {
-    "name": "ListManagedAccountsForParent",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list managed accounts under an organizational unit",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listmanagedorganizationalunits": {
-    "name": "ListManagedOrganizationalUnits",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list organizational units managed by AWS Control Tower",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "listmanagedorganizationalunitsforguardrail": {
-    "name": "ListManagedOrganizationalUnitsForGuardrail",
-    "isPermissionOnly": true,
-    "description": "Grants permission to list managed organizational units that have a specified guardrail applied",
-    "accessLevel": "List",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listtagsforresource": {
     "name": "ListTagsForResource",
     "description": "Grants permission to list the tags for a resource",
@@ -543,24 +539,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "manageorganizationalunit": {
-    "name": "ManageOrganizationalUnit",
-    "isPermissionOnly": true,
-    "description": "Grants permission to set up an organizational unit to be managed by AWS Control Tower",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
-  "performprelaunchchecks": {
-    "name": "PerformPreLaunchChecks",
-    "isPermissionOnly": true,
-    "description": "Grants permission to perform validations in an account",
-    "accessLevel": "Read",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "resetenabledbaseline": {
     "name": "ResetEnabledBaseline",
     "description": "Grants permission to reset an enabled Baseline",
@@ -606,19 +584,10 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "setuplandingzone": {
-    "name": "SetupLandingZone",
-    "isPermissionOnly": true,
-    "description": "Grants permission to set up or update AWS Control Tower landing zone",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add tags to a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "EnabledBaseline",
@@ -648,7 +617,7 @@
   "untagresource": {
     "name": "UntagResource",
     "description": "Grants permission to remove tags from a resource",
-    "accessLevel": "Tagging",
+    "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
         "name": "EnabledBaseline",
@@ -674,15 +643,6 @@
     ],
     "dependentActions": []
   },
-  "updateaccountfactoryconfig": {
-    "name": "UpdateAccountFactoryConfig",
-    "isPermissionOnly": true,
-    "description": "Grants permission to update the account factory configuration",
-    "accessLevel": "Write",
-    "resourceTypes": [],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "updateenabledbaseline": {
     "name": "UpdateEnabledBaseline",
     "description": "Grants permission to update an enabled Baseline",

package/data/actions/cost-optimization-hub.json

@@ -37,9 +37,7 @@
     "accessLevel": "List",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "cost-optimization-hub:GetRecommendation"
-    ]
+    "dependentActions": []
   },
   "listrecommendations": {
     "name": "ListRecommendations",
@@ -47,9 +45,7 @@
     "accessLevel": "List",
     "resourceTypes": [],
     "conditionKeys": [],
-    "dependentActions": [
-      "cost-optimization-hub:GetRecommendation"
-    ]
+    "dependentActions": []
   },
   "updateenrollmentstatus": {
     "name": "UpdateEnrollmentStatus",