@cloud-copilot/iam-data 0.21.202608071 → 0.21.202608131

package/data/actions/quicksight.json

@@ -147,6 +147,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describedlpjob": {
+    "name": "DescribeDlpJob",
+    "description": "Grants permission to describe a DLP evaluation job",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describeemailcustomizationtemplate": {
     "name": "DescribeEmailCustomizationTemplate",
     "description": "Grants permission to describe a QuickSight email customization template",
@@ -232,6 +247,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdlplabels": {
+    "name": "ListDlpLabels",
+    "description": "Grants permission to list sensitivity labels available from a DLP provider",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listextensionaccesses": {
     "name": "ListExtensionAccesses",
     "description": "Grants permission to list extension accesses",
@@ -373,6 +396,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "startdlpjob": {
+    "name": "StartDlpJob",
+    "description": "Grants permission to start a DLP evaluation job",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "subscribe": {
     "name": "Subscribe",
     "description": "Grants permission to subscribe to Amazon QuickSight, and also to allow the user to upgrade the subscription to Enterprise edition",
@@ -461,21 +499,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "batchassignlimitsprofile": {
-    "name": "BatchAssignLimitsProfile",
-    "description": "Grants permission to assign a limits profile to targets",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "limitsProfile",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "batchcreatetopicreviewedanswer": {
     "name": "BatchCreateTopicReviewedAnswer",
     "description": "Grants permission to create reviewed answers for a topic",
@@ -527,10 +550,10 @@
     ],
     "dependentActions": []
   },
-  "batchunassignlimitsprofile": {
-    "name": "BatchUnassignLimitsProfile",
-    "description": "Grants permission to unassign a limits profile from targets",
-    "accessLevel": "Write",
+  "batchdescribeuserlimits": {
+    "name": "BatchDescribeUserLimits",
+    "description": "Grants permission to describe the effective resource limits for users",
+    "accessLevel": "Read",
     "resourceTypes": [
       {
         "name": "limitsProfile",
@@ -633,6 +656,21 @@
     ],
     "dependentActions": []
   },
+  "createapprovalpolicy": {
+    "name": "CreateApprovalPolicy",
+    "description": "Grants permission to create an approval policy for governed actions",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "approvalPolicy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createbrand": {
     "name": "CreateBrand",
     "description": "Grants permission to create an Amazon QuickSight brand",
@@ -716,6 +754,24 @@
     ],
     "dependentActions": []
   },
+  "createdlpsetting": {
+    "name": "CreateDlpSetting",
+    "description": "Grants permission to create a DLP setting",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
   "createflow": {
     "name": "CreateFlow",
     "description": "Grants permission to create a flow",
@@ -1172,6 +1228,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deleteapprovalpolicy": {
+    "name": "DeleteApprovalPolicy",
+    "description": "Grants permission to delete an approval policy",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "approvalPolicy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletebrand": {
     "name": "DeleteBrand",
     "description": "Grants permission to delete an Amazon QuickSight brand",
@@ -1277,6 +1348,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletedlpsetting": {
+    "name": "DeleteDlpSetting",
+    "description": "Grants permission to delete a DLP setting",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deleteflow": {
     "name": "DeleteFlow",
     "description": "Grants permission to delete a flow",
@@ -1828,6 +1914,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describeapprovalpolicy": {
+    "name": "DescribeApprovalPolicy",
+    "description": "Grants permission to describe an approval policy",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "approvalPolicy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describeassetbundleexportjob": {
     "name": "DescribeAssetBundleExportJob",
     "description": "Grants permission to describe an asset bundle export job",
@@ -2119,6 +2220,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describedlpsetting": {
+    "name": "DescribeDlpSetting",
+    "description": "Grants permission to describe a DLP setting",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describeflow": {
     "name": "DescribeFlow",
     "description": "Grants permission to describe a flow",
@@ -2775,6 +2891,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listapprovalpolicies": {
+    "name": "ListApprovalPolicies",
+    "description": "Grants permission to list approval policies",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "approvalPolicy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listapps": {
     "name": "ListApps",
     "description": "Grants permission to list all apps in a QuickSight account",
@@ -2820,21 +2951,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "listassignmentsforprincipal": {
-    "name": "ListAssignmentsForPrincipal",
-    "description": "Grants permission to list limits profile assignments for a principal",
-    "accessLevel": "List",
-    "resourceTypes": [
-      {
-        "name": "limitsProfile",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listautomationgroups": {
     "name": "ListAutomationGroups",
     "description": "Grants permission to list all automation groups in an account",
@@ -2911,6 +3027,21 @@
     ],
     "dependentActions": []
   },
+  "listdlpsettings": {
+    "name": "ListDlpSettings",
+    "description": "Grants permission to list DLP settings in an account",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listflows": {
     "name": "ListFlows",
     "description": "Grants permission to list all flows in an Amazon QuickSight account",
@@ -3109,21 +3240,6 @@
     ],
     "dependentActions": []
   },
-  "listprofileassignments": {
-    "name": "ListProfileAssignments",
-    "description": "Grants permission to list assignments for a limits profile",
-    "accessLevel": "List",
-    "resourceTypes": [
-      {
-        "name": "limitsProfile",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [],
-    "dependentActions": []
-  },
   "listrefreshschedules": {
     "name": "ListRefreshSchedules",
     "description": "Grants permission to list all refresh schedules on a dataset",
@@ -3237,6 +3353,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dlpSetting",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "emailCustomizationTemplate",
         "required": false,
@@ -3850,6 +3972,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dlpSetting",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "emailCustomizationTemplate",
         "required": false,
@@ -3982,6 +4110,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dlpSetting",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "emailCustomizationTemplate",
         "required": false,
@@ -4198,6 +4332,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updateapprovalpolicy": {
+    "name": "UpdateApprovalPolicy",
+    "description": "Grants permission to update an approval policy",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "approvalPolicy",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updateautomationgrouppermissions": {
     "name": "UpdateAutomationGroupPermissions",
     "description": "Grants permission to update permissions for an automation group",
@@ -4420,6 +4569,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updatedlpsetting": {
+    "name": "UpdateDlpSetting",
+    "description": "Grants permission to update a DLP setting",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "dlpSetting",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updateflow": {
     "name": "UpdateFlow",
     "description": "Grants permission to update a flow",

package/data/actions/securityagent.json

@@ -1544,6 +1544,12 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "Integration",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],

package/data/actions/securityhub.json

@@ -1449,6 +1449,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listfreetrialstatusesv2": {
+    "name": "ListFreeTrialStatusesV2",
+    "description": "Grants permission to retrieve a list of Security Hub free trial statuses for an account or accounts in an organization",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "hubv2",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listinvitations": {
     "name": "ListInvitations",
     "description": "Grants permission to retrieve the Security Hub invitations sent to the account",

package/data/actions/transform-custom.json

@@ -328,6 +328,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getanalysisartifactdownloadurl": {
+    "name": "GetAnalysisArtifactDownloadUrl",
+    "description": "Grants permission to invoke GetAnalysisArtifactDownloadUrl on AWS Transform custom",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "analysis",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getcampaign": {
     "name": "GetCampaign",
     "description": "Grants permission to invoke GetCampaign on AWS Transform custom",
@@ -463,6 +480,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listanalysisartifacts": {
+    "name": "ListAnalysisArtifacts",
+    "description": "Grants permission to invoke ListAnalysisArtifacts on AWS Transform custom",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "analysis",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listcampaignrepositories": {
     "name": "ListCampaignRepositories",
     "description": "Grants permission to invoke ListCampaignRepositories on AWS Transform custom",

package/data/actions/workspaces.json

@@ -284,6 +284,15 @@
           "aws:ResourceTag/${TagKey}"
         ],
         "dependentActions": []
+      },
+      {
+        "name": "workspaceid",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -324,6 +333,15 @@
     "description": "Grants permission to create a WorkSpace bundle",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "workspacebundle",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "workspaceimage",
         "required": true,
@@ -348,6 +366,15 @@
           "aws:ResourceTag/${TagKey}"
         ],
         "dependentActions": []
+      },
+      {
+        "name": "workspaceimage",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -373,6 +400,15 @@
           "aws:ResourceTag/${TagKey}"
         ],
         "dependentActions": []
+      },
+      {
+        "name": "workspaceid",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -398,6 +434,15 @@
           "aws:ResourceTag/${TagKey}"
         ],
         "dependentActions": []
+      },
+      {
+        "name": "workspacespool",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],

package/data/categories/machine-learning-and-ai.json

@@ -2,6 +2,7 @@
   "key": "machine-learning-and-ai",
   "name": "Machine Learning (ML) and Artificial Intelligence (AI)",
   "services": [
+    "agent-registry",
     "aidevops",
     "aiops",
     "aws-external-anthropic",

package/data/categories/security-identity-and-compliance.json

@@ -3,6 +3,7 @@
   "name": "Security, identity, and compliance",
   "services": [
     "access-analyzer",
+    "account-access",
     "acm",
     "acm-pca",
     "artifact",

package/data/conditionKeys/account-access.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by tag keys",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/agent-registry.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by creating requests based on the allowed set of values for each of the mandatory tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by having actions based on the tag value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by creating requests based on the presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/airflow.json

@@ -19,8 +19,8 @@
     "description": "Filters access by the Airflow resource type specified in the request",
     "type": "String"
   },
-  "airflow:teamname": {
-    "key": "airflow:TeamName",
+  "airflow:teamnames": {
+    "key": "airflow:TeamNames",
     "description": "Filters access by the team names associated with the caller's identity, enabling team-based access control for Airflow resources",
     "type": "ArrayOfString"
   },

package/data/conditionKeys/autoscaling.json

@@ -69,6 +69,11 @@
     "description": "Filters access based on the minimum scaling size in the request",
     "type": "Numeric"
   },
+  "autoscaling:operatorprincipal": {
+    "key": "autoscaling:OperatorPrincipal",
+    "description": "Filters access based on the the operator for EC2 Managed Instances",
+    "type": "String"
+  },
   "autoscaling:resourcetag/${tagkey}": {
     "key": "autoscaling:ResourceTag/${TagKey}",
     "description": "Filters access based on the tags associated with the resource",

package/data/conditionKeys/bedrock-agentcore.json

@@ -134,6 +134,11 @@
     "description": "Filters access by namespace",
     "type": "String"
   },
+  "bedrock-agentcore:runtimesessionid": {
+    "key": "bedrock-agentcore:runtimeSessionId",
+    "description": "Filters access by Runtime Session Id",
+    "type": "String"
+  },
   "bedrock-agentcore:securitygroups": {
     "key": "bedrock-agentcore:securityGroups",
     "description": "Filters access by the ID of security groups configured for an AgentCore resource",
@@ -141,7 +146,7 @@
   },
   "bedrock-agentcore:sessionid": {
     "key": "bedrock-agentcore:sessionId",
-    "description": "Filters access by Session Id",
+    "description": "Filters access by Memory Session Id",
     "type": "String"
   },
   "bedrock-agentcore:strategyid": {

package/data/conditionKeys/eks.json

@@ -99,6 +99,21 @@
     "description": "Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service",
     "type": "String"
   },
+  "eks:kubeapiserverconfig": {
+    "key": "eks:kubeApiServerConfig",
+    "description": "Filters access by whether the kube-api-server configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:kubecontrollermanagerconfig": {
+    "key": "eks:kubeControllerManagerConfig",
+    "description": "Filters access by whether the kube-controller-manager configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:kubeschedulerconfig": {
+    "key": "eks:kubeSchedulerConfig",
+    "description": "Filters access by whether the kube-scheduler configuration is present in the create / update cluster request",
+    "type": "Bool"
+  },
   "eks:kubernetesgroups": {
     "key": "eks:kubernetesGroups",
     "description": "Filters access by the kubernetesGroups present in the access entry requests the user makes to the EKS service",