@cloud-copilot/iam-data 0.21.202608191 → 0.21.202608201

package/data/actions/bedrock.json

@@ -598,6 +598,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createdatasourcetoken": {
+    "name": "CreateDataSourceToken",
+    "description": "Grants permission to create an authorization token for MANAGED_OAUTH2 data source",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createevaluationjob": {
     "name": "CreateEvaluationJob",
     "description": "Grants permission to create a job for evaluation foundation models or custom models",
@@ -1986,6 +1994,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdatasourceauthorizationurl": {
+    "name": "GetDataSourceAuthorizationUrl",
+    "description": "Grants permission to get the authorization URL for a MANAGED_OAUTH2 data source",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getdocumentcontent": {
     "name": "GetDocumentContent",
     "description": "Grants permission to retrieve a document",

package/data/actions/dynamodb.json

@@ -817,7 +817,7 @@
     "resourceTypes": [
       {
         "name": "stream",
-        "required": false,
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       },
@@ -1076,7 +1076,7 @@
     "resourceTypes": [
       {
         "name": "stream",
-        "required": false,
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       },
@@ -1100,7 +1100,7 @@
     "resourceTypes": [
       {
         "name": "stream",
-        "required": false,
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       },

package/data/actions/ec2.json

@@ -1100,6 +1100,49 @@
     ],
     "dependentActions": []
   },
+  "associateapplicationstatuscheck": {
+    "name": "AssociateApplicationStatusCheck",
+    "description": "Grants permission to associate an application status check with instances or tags",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:EbsOptimized",
+          "ec2:InstanceAutoRecovery",
+          "ec2:InstanceBandwidthWeighting",
+          "ec2:InstanceMarketType",
+          "ec2:InstanceMetadataTags",
+          "ec2:InstanceProfile",
+          "ec2:InstanceType",
+          "ec2:MetadataHttpEndpoint",
+          "ec2:MetadataHttpPutResponseHopLimit",
+          "ec2:MetadataHttpTokens",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:RootDeviceType",
+          "ec2:Tenancy"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "associatecapacityreservationbillingowner": {
     "name": "AssociateCapacityReservationBillingOwner",
     "description": "Grants permission to assign billing of the unused capacity of a shared Capacity Reservation to a consumer account",
@@ -1386,8 +1429,6 @@
         "required": true,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -1484,8 +1525,6 @@
         "required": true,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -2420,6 +2459,48 @@
     ],
     "dependentActions": []
   },
+  "createapplicationstatuscheck": {
+    "name": "CreateApplicationStatusCheck",
+    "description": "Grants permission to create an application status check for monitoring the health of applications running on instances",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "security-group",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:Vpc"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "subnet",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:Vpc"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "createcapacitymanagerdataexport": {
     "name": "CreateCapacityManagerDataExport",
     "description": "Grants permission to create a new S3 Data Export for Capacity Manager",
@@ -3965,8 +4046,6 @@
         "required": false,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -4850,6 +4929,17 @@
     "description": "Grants permission to add or overwrite one or more tags for Amazon EC2 resources",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": false,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "capacity-block",
         "required": false,
@@ -6507,6 +6597,37 @@
     ],
     "dependentActions": []
   },
+  "createtransitgatewaypolicytableentry": {
+    "name": "CreateTransitGatewayPolicyTableEntry",
+    "description": "Grants permission to create an entry in a transit gateway policy table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "transit-gateway-policy-table",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:transitGatewayPolicyTableId"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "transit-gateway-route-table",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:transitGatewayRouteTableId"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "createtransitgatewayprefixlistreference": {
     "name": "CreateTransitGatewayPrefixListReference",
     "description": "Grants permission to create a transit gateway prefix list reference",
@@ -6950,8 +7071,6 @@
         "required": false,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -7313,6 +7432,26 @@
     ],
     "dependentActions": []
   },
+  "deleteapplicationstatuscheck": {
+    "name": "DeleteApplicationStatusCheck",
+    "description": "Grants permission to delete an application status check",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "deletecapacitymanagerdataexport": {
     "name": "DeleteCapacityManagerDataExport",
     "description": "Grants permission to delete an existing Capacity Manager data export configuration",
@@ -8540,6 +8679,17 @@
     "description": "Grants permission to delete one or more tags from Amazon EC2 resources",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": false,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "capacity-block",
         "required": false,
@@ -9969,6 +10119,27 @@
     ],
     "dependentActions": []
   },
+  "deletetransitgatewaypolicytableentry": {
+    "name": "DeleteTransitGatewayPolicyTableEntry",
+    "description": "Grants permission to delete an entry from a transit gateway policy table",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "transit-gateway-policy-table",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:transitGatewayPolicyTableId"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "deletetransitgatewayprefixlistreference": {
     "name": "DeleteTransitGatewayPrefixListReference",
     "description": "Grants permission to delete a transit gateway prefix list reference",
@@ -10661,6 +10832,36 @@
     ],
     "dependentActions": []
   },
+  "describeapplicationstatus": {
+    "name": "DescribeApplicationStatus",
+    "description": "Grants permission to describe the aggregated application health status for instances",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "describeapplicationstatuscheckassociations": {
+    "name": "DescribeApplicationStatusCheckAssociations",
+    "description": "Grants permission to describe the associations for one or more application status checks",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "describeapplicationstatuschecks": {
+    "name": "DescribeApplicationStatusChecks",
+    "description": "Grants permission to describe application status checks",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "describeavailabilityzones": {
     "name": "DescribeAvailabilityZones",
     "description": "Grants permission to describe one or more of the Availability Zones that are available to you",
@@ -13044,6 +13245,40 @@
     ],
     "dependentActions": []
   },
+  "disableapplicationstatuschecksuppression": {
+    "name": "DisableApplicationStatusCheckSuppression",
+    "description": "Grants permission to disable suppression of application status checks for instances",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:EbsOptimized",
+          "ec2:InstanceAutoRecovery",
+          "ec2:InstanceBandwidthWeighting",
+          "ec2:InstanceMarketType",
+          "ec2:InstanceMetadataTags",
+          "ec2:InstanceProfile",
+          "ec2:InstanceType",
+          "ec2:MetadataHttpEndpoint",
+          "ec2:MetadataHttpPutResponseHopLimit",
+          "ec2:MetadataHttpTokens",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:RootDeviceType",
+          "ec2:Tenancy"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "disableawsnetworkperformancemetricsubscription": {
     "name": "DisableAwsNetworkPerformanceMetricSubscription",
     "description": "Grants permission to disable infrastructure performance metric subscriptions",
@@ -13480,6 +13715,49 @@
     ],
     "dependentActions": []
   },
+  "disassociateapplicationstatuscheck": {
+    "name": "DisassociateApplicationStatusCheck",
+    "description": "Grants permission to disassociate an application status check from instances or tags",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:EbsOptimized",
+          "ec2:InstanceAutoRecovery",
+          "ec2:InstanceBandwidthWeighting",
+          "ec2:InstanceMarketType",
+          "ec2:InstanceMetadataTags",
+          "ec2:InstanceProfile",
+          "ec2:InstanceType",
+          "ec2:MetadataHttpEndpoint",
+          "ec2:MetadataHttpPutResponseHopLimit",
+          "ec2:MetadataHttpTokens",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:RootDeviceType",
+          "ec2:Tenancy"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "disassociatecapacityreservationbillingowner": {
     "name": "DisassociateCapacityReservationBillingOwner",
     "description": "Grants permission to cancel a pending request to assign billing of the unused capacity of a Capacity Reservation to a consumer account",
@@ -13720,8 +13998,6 @@
         "required": true,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -13827,8 +14103,6 @@
         "required": false,
         "conditionKeys": [
           "aws:ResourceTag/${TagKey}",
-          "ec2:Ipv4IpamPoolId",
-          "ec2:Ipv6IpamPoolId",
           "ec2:ResourceTag/${TagKey}",
           "ec2:Tenancy",
           "ec2:VpcID"
@@ -14036,6 +14310,40 @@
     ],
     "dependentActions": []
   },
+  "enableapplicationstatuschecksuppression": {
+    "name": "EnableApplicationStatusCheckSuppression",
+    "description": "Grants permission to suppress application status checks for instances",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:EbsOptimized",
+          "ec2:InstanceAutoRecovery",
+          "ec2:InstanceBandwidthWeighting",
+          "ec2:InstanceMarketType",
+          "ec2:InstanceMetadataTags",
+          "ec2:InstanceProfile",
+          "ec2:InstanceType",
+          "ec2:MetadataHttpEndpoint",
+          "ec2:MetadataHttpPutResponseHopLimit",
+          "ec2:MetadataHttpTokens",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:RootDeviceType",
+          "ec2:Tenancy"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "enableawsnetworkperformancemetricsubscription": {
     "name": "EnableAwsNetworkPerformanceMetricSubscription",
     "description": "Grants permission to enable infrastructure performance subscriptions",
@@ -16223,6 +16531,50 @@
     ],
     "dependentActions": []
   },
+  "modifyapplicationstatuscheck": {
+    "name": "ModifyApplicationStatusCheck",
+    "description": "Grants permission to modify an application status check",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "application-status-check",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:Attribute",
+          "ec2:Attribute/${AttributeName}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "security-group",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:Vpc"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "subnet",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:AvailabilityZone",
+          "ec2:AvailabilityZoneId",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:Vpc"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "modifyavailabilityzonegroup": {
     "name": "ModifyAvailabilityZoneGroup",
     "description": "Grants permission to modify the opt-in status of the Local Zone and Wavelength Zone group for your account",
@@ -17847,6 +18199,37 @@
     ],
     "dependentActions": []
   },
+  "modifytransitgatewaypolicytableentry": {
+    "name": "ModifyTransitGatewayPolicyTableEntry",
+    "description": "Grants permission to modify a transit gateway policy table entry",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "transit-gateway-policy-table",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:transitGatewayPolicyTableId"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "transit-gateway-route-table",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:transitGatewayRouteTableId"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "modifytransitgatewayprefixlistreference": {
     "name": "ModifyTransitGatewayPrefixListReference",
     "description": "Grants permission to modify a transit gateway prefix list reference",
@@ -18342,6 +18725,28 @@
     ],
     "dependentActions": []
   },
+  "modifyvpcendpointpayerresponsibility": {
+    "name": "ModifyVpcEndpointPayerResponsibility",
+    "description": "Grants permission to modify the payer responsibility for a VPC endpoint",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "vpc-endpoint-service",
+        "required": false,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}",
+          "ec2:VpceMultiRegion",
+          "ec2:VpceSupportedRegion"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "modifyvpcendpointserviceconfiguration": {
     "name": "ModifyVpcEndpointServiceConfiguration",
     "description": "Grants permission to modify the attributes of a VPC endpoint service configuration",
@@ -20712,6 +21117,12 @@
     "description": "Grants permission to start a stopped instance",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "group",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "instance",
         "required": true,

package/data/actions/eks.json

@@ -29,6 +29,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "activatecertificateauthority": {
+    "name": "ActivateCertificateAuthority",
+    "description": "Grants permission to activate a certificate authority for an Amazon EKS cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "associateaccesspolicy": {
     "name": "AssociateAccessPolicy",
     "description": "Grants permission to associate an Amazon EKS access policy to an Amazon EKS access entry",
@@ -164,6 +179,21 @@
     ],
     "dependentActions": []
   },
+  "createcertificateauthority": {
+    "name": "CreateCertificateAuthority",
+    "description": "Grants permission to create a certificate authority for an Amazon EKS cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createcluster": {
     "name": "CreateCluster",
     "description": "Grants permission to create an Amazon EKS cluster",
@@ -310,6 +340,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletecertificateauthority": {
+    "name": "DeleteCertificateAuthority",
+    "description": "Grants permission to delete a certificate authority from an Amazon EKS cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletecluster": {
     "name": "DeleteCluster",
     "description": "Grants permission to delete an Amazon EKS cluster",
@@ -461,6 +506,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describecertificateauthority": {
+    "name": "DescribeCertificateAuthority",
+    "description": "Grants permission to retrieve descriptive information about a certificate authority for an Amazon EKS cluster",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describecluster": {
     "name": "DescribeCluster",
     "description": "Grants permission to retrieve descriptive information about an Amazon EKS cluster",
@@ -724,6 +784,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listcertificateauthorities": {
+    "name": "ListCertificateAuthorities",
+    "description": "Grants permission to list the certificate authorities for an Amazon EKS cluster",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listclusters": {
     "name": "ListClusters",
     "description": "Grants permission to list the Amazon EKS clusters in your AWS account (in the specified or default region)",

package/data/actions/ssm.json

@@ -45,6 +45,30 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "requestmanagedinstanceroletoken": {
+    "name": "RequestManagedInstanceRoleToken",
+    "description": "Grants permission to SSM Agent to retrieve temporary credentials to access the managed node (internal Systems Manager call)",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "managed-instance",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ssm:NodeAccountId",
+      "ssm:NodeOrgId"
+    ],
+    "dependentActions": []
+  },
   "updateinstanceassociationstatus": {
     "name": "UpdateInstanceAssociationStatus",
     "description": "Grants permission to SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)",
@@ -76,6 +100,30 @@
     ],
     "dependentActions": []
   },
+  "updatemanagedinstancepublickey": {
+    "name": "UpdateManagedInstancePublicKey",
+    "description": "Grants permission to SSM Agent to update the public key of the managed node after rotating the key pair (internal Systems Manager call)",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "managed-instance",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ssm:NodeAccountId",
+      "ssm:NodeOrgId"
+    ],
+    "dependentActions": []
+  },
   "addtagstoresource": {
     "name": "AddTagsToResource",
     "description": "Grants permission to add or overwrite one or more tags for a specified AWS resource",
@@ -1952,7 +2000,9 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "ssm:NodeAccountId",
+      "ssm:NodeOrgId"
     ],
     "dependentActions": []
   },

package/data/actions/workspaces.json

@@ -67,6 +67,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "invokeonboardingagent": {
+    "name": "InvokeOnboardingAgent",
+    "description": "Grants permission to use WorkSpaces Advisor for WorkSpace onboarding",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "invoketroubleshootinginvestigation": {
     "name": "InvokeTroubleshootingInvestigation",
     "description": "Grants permission to invoke troubleshooting investigation",
@@ -97,6 +105,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "personalization": {
+    "name": "Personalization",
+    "description": "Grants permission to manage features that enable personalization of the WorkSpaces console experience",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updateconsent": {
     "name": "UpdateConsent",
     "description": "Grants permission to update the consent agreement to BYOL minimum requirements",

package/data/conditionKeys/ssm.json

@@ -49,6 +49,16 @@
     "description": "Filters access by verifying that a user also has access to the InventoryType specified in the request",
     "type": "ArrayOfString"
   },
+  "ssm:nodeaccountid": {
+    "key": "ssm:NodeAccountId",
+    "description": "Filters access by the AWS account ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)",
+    "type": "String"
+  },
+  "ssm:nodeorgid": {
+    "key": "ssm:NodeOrgId",
+    "description": "Filters access by the AWS Organizations ID associated with the managed node making the request. Available only in VPC endpoint policies and service control policies (SCPs)",
+    "type": "String"
+  },
   "ssm:overwrite": {
     "key": "ssm:Overwrite",
     "description": "Filters access by controling whether Systems Manager parameters can be overwritten",

package/data/resourceTypes/dynamodb.json

@@ -24,7 +24,10 @@
   },
   "stream": {
     "key": "stream",
-    "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/stream/${StreamLabel}"
+    "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/stream/${StreamLabel}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "table": {
     "key": "table",

package/data/resourceTypes/ec2.json

@@ -1,4 +1,17 @@
 {
+  "application-status-check": {
+    "key": "application-status-check",
+    "arn": "arn:${Partition}:ec2:${Region}:${Account}:application-status-check/${ApplicationStatusCheckId}",
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys",
+      "ec2:Attribute",
+      "ec2:Attribute/${AttributeName}",
+      "ec2:Region",
+      "ec2:ResourceTag/${TagKey}"
+    ]
+  },
   "capacity-block": {
     "key": "capacity-block",
     "arn": "arn:${Partition}:ec2:${Region}:${Account}:capacity-block/${CapacityBlockId}",

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.21.202608191",
+  "version": "0.21.202608201",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud-copilot/iam-data.git"
   },
-  "updatedAt": "2026-08-19T04:53:48.040Z",
+  "updatedAt": "2026-08-20T04:52:14.880Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",