@cloud-copilot/iam-data 0.21.202608304 → 0.21.202609021

package/LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Cloud Copilot
+Copyright (c) 2024 Act Security
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -11,11 +11,11 @@ Data is scanned daily and a new version is published if there are changes. The v
 ## Usage
 
 ```bash
-npm install @cloud-copilot/iam-data
+npm install @actsecurity/iam-data
 ```
 
 ```typescript
-import { iamServiceKeys, iamActionDetails, iamActionsForService, iamServiceName } from '@cloud-copilot/iam-data';
+import { iamServiceKeys, iamActionDetails, iamActionsForService, iamServiceName } from '@actsecurity/iam-data';
 
 // Iterate through all actions in all services
 const serviceKeys = await iamServiceKeys()

package/data/actions/cognito-idp.json

@@ -140,6 +140,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "admindeletesoftwaretoken": {
+    "name": "AdminDeleteSoftwareToken",
+    "description": "Grants permission to delete a user's software token",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "userpool",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "admindeleteuser": {
     "name": "AdminDeleteUser",
     "description": "Grants permission to delete any user",

package/data/actions/connect.json

@@ -1052,6 +1052,25 @@
     ],
     "dependentActions": []
   },
+  "createextractiondefinition": {
+    "name": "CreateExtractionDefinition",
+    "description": "Grants permission to create an extraction definition in an Amazon Connect instance",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "extraction-definition",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "createhoursofoperation": {
     "name": "CreateHoursOfOperation",
     "description": "Grants permission to create hours of operation in an Amazon Connect instance",
@@ -1867,6 +1886,24 @@
     ],
     "dependentActions": []
   },
+  "deleteextractiondefinition": {
+    "name": "DeleteExtractionDefinition",
+    "description": "Grants permission to delete an extraction definition in an Amazon Connect instance",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "extraction-definition",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "deletehoursofoperation": {
     "name": "DeleteHoursOfOperation",
     "description": "Grants permission to delete hours of operation in an Amazon Connect instance",
@@ -2546,6 +2583,24 @@
     ],
     "dependentActions": []
   },
+  "describeextractiondefinition": {
+    "name": "DescribeExtractionDefinition",
+    "description": "Grants permission to describe an extraction definition in an Amazon Connect instance",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "extraction-definition",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "describehoursofoperation": {
     "name": "DescribeHoursOfOperation",
     "description": "Grants permission to describe hours of operation in an Amazon Connect instance",
@@ -3402,6 +3457,23 @@
     ],
     "dependentActions": []
   },
+  "getcrossregionrouting": {
+    "name": "GetCrossRegionRouting",
+    "description": "Grants permission to retrieve the cross-region routing configuration for an Amazon Connect Global Resiliency instance",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "getcurrentmetricdata": {
     "name": "GetCurrentMetricData",
     "description": "Grants permission to retrieve current metric data for queues and routing profiles in an Amazon Connect instance",
@@ -4096,6 +4168,23 @@
     ],
     "dependentActions": []
   },
+  "listextractiondefinitions": {
+    "name": "ListExtractionDefinitions",
+    "description": "Grants permission to list extraction definitions associated with an Amazon Connect instance",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "listflowassociations": {
     "name": "ListFlowAssociations",
     "description": "Grants permission to list summary information about the flow associations for the specified Amazon Connect instance",
@@ -4645,6 +4734,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "extraction-definition",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "hierarchy-group",
         "required": false,
@@ -6191,6 +6286,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "extraction-definition",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "hierarchy-group",
         "required": false,
@@ -6407,6 +6508,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "extraction-definition",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "hierarchy-group",
         "required": false,
@@ -6785,6 +6892,23 @@
     ],
     "dependentActions": []
   },
+  "updatecrossregionrouting": {
+    "name": "UpdateCrossRegionRouting",
+    "description": "Grants permission to update the cross-region routing configuration for an Amazon Connect Global Resiliency instance",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "instance",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "updatedatatableattribute": {
     "name": "UpdateDataTableAttribute",
     "description": "Grants permission to update an attribute of a data table in an Amazon Connect instance",
@@ -6875,6 +6999,24 @@
     ],
     "dependentActions": []
   },
+  "updateextractiondefinition": {
+    "name": "UpdateExtractionDefinition",
+    "description": "Grants permission to update an extraction definition in an Amazon Connect instance",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "extraction-definition",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "connect:InstanceId"
+    ],
+    "dependentActions": []
+  },
   "updatehoursofoperation": {
     "name": "UpdateHoursOfOperation",
     "description": "Grants permission to update hours of operation in an Amazon Connect instance",

package/data/actions/ec2.json

@@ -2107,6 +2107,26 @@
     ],
     "dependentActions": []
   },
+  "batchmodifyipamroutingpolicyregistrations": {
+    "name": "BatchModifyIpamRoutingPolicyRegistrations",
+    "description": "Grants permission to modify multiple routing policy registrations in a single operation",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "bundleinstance": {
     "name": "BundleInstance",
     "description": "Grants permission to bundle an instance store-backed Windows instance",
@@ -3478,6 +3498,35 @@
     ],
     "dependentActions": []
   },
+  "createipaminternetregistryassociation": {
+    "name": "CreateIpamInternetRegistryAssociation",
+    "description": "Grants permission to create an association between an IPAM and a Regional Internet Registry (RIR) for Resource Public Key Infrastructure (RPKI) management",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "createipampolicy": {
     "name": "CreateIpamPolicy",
     "description": "Grants permission to create a policy in Amazon VPC IP Address Manager (IPAM) that defines rules for allocating public IPv4 addresses from IPAM pools to AWS resources",
@@ -3623,6 +3672,26 @@
     ],
     "dependentActions": []
   },
+  "createipamroutingpolicyregistration": {
+    "name": "CreateIpamRoutingPolicyRegistration",
+    "description": "Grants permission to create a routing policy registration and publish Route Origin Authorizations (ROAs) to the RPKI",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "createipamscope": {
     "name": "CreateIpamScope",
     "description": "Grants permission to create an Amazon VPC IP Address Manager (IPAM) scope, which is the highest-level container within IPAM",
@@ -5315,6 +5384,17 @@
         ],
         "dependentActions": []
       },
+      {
+        "name": "ipam-internet-registry-association",
+        "required": false,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "ipam-policy",
         "required": false,
@@ -7842,6 +7922,26 @@
     ],
     "dependentActions": []
   },
+  "deleteipaminternetregistryassociation": {
+    "name": "DeleteIpamInternetRegistryAssociation",
+    "description": "Grants permission to delete an IPAM internet registry association",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "deleteipampolicy": {
     "name": "DeleteIpamPolicy",
     "description": "Grants permission to delete an Amazon VPC IP Address Manager (IPAM) policy",
@@ -7942,6 +8042,26 @@
     ],
     "dependentActions": []
   },
+  "deleteipamroutingpolicyregistration": {
+    "name": "DeleteIpamRoutingPolicyRegistration",
+    "description": "Grants permission to delete a routing policy registration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "deleteipamscope": {
     "name": "DeleteIpamScope",
     "description": "Grants permission to delete the scope for an Amazon VPC IP Address Manager (IPAM)",
@@ -9020,6 +9140,17 @@
         ],
         "dependentActions": []
       },
+      {
+        "name": "ipam-internet-registry-association",
+        "required": false,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "ipam-policy",
         "required": false,
@@ -10792,6 +10923,16 @@
     ],
     "dependentActions": []
   },
+  "describeaccountvpcencryptioncontrol": {
+    "name": "DescribeAccountVpcEncryptionControl",
+    "description": "Grants permission to describe the account-level VPC Encryption Control configuration",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "describeaddresstransfers": {
     "name": "DescribeAddressTransfers",
     "description": "Grants permission to describe an Elastic IP address transfer",
@@ -11700,6 +11841,16 @@
     ],
     "dependentActions": []
   },
+  "describeipaminternetregistryassociations": {
+    "name": "DescribeIpamInternetRegistryAssociations",
+    "description": "Grants permission to describe IPAM internet registry associations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "describeipampolicies": {
     "name": "DescribeIpamPolicies",
     "description": "Grants permission to describe Amazon VPC IP Address Manager (IPAM) policies",
@@ -14556,6 +14707,26 @@
     ],
     "dependentActions": []
   },
+  "enableipaminternetregistryassociation": {
+    "name": "EnableIpamInternetRegistryAssociation",
+    "description": "Grants permission to enable Resource Public Key Infrastructure (RPKI) on an IPAM internet registry association",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "enableipamorganizationadminaccount": {
     "name": "EnableIpamOrganizationAdminAccount",
     "description": "Grants permission to enable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account",
@@ -15466,6 +15637,66 @@
     ],
     "dependentActions": []
   },
+  "getipamdiscoveredroutes": {
+    "name": "GetIpamDiscoveredRoutes",
+    "description": "Grants permission to retrieve Border Gateway Protocol (BGP) routes discovered by IPAM resource discovery",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-resource-discovery",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "getipaminternetregistryassociationasns": {
+    "name": "GetIpamInternetRegistryAssociationAsns",
+    "description": "Grants permission to retrieve Autonomous System Numbers (ASNs) registered with an internet registry for an IPAM internet registry association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "getipaminternetregistryassociationcidrs": {
+    "name": "GetIpamInternetRegistryAssociationCidrs",
+    "description": "Grants permission to retrieve IP address CIDRs registered with an internet registry for an IPAM internet registry association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "getipampolicyallocationrules": {
     "name": "GetIpamPolicyAllocationRules",
     "description": "Grants permission to describe the rules that define how Amazon VPC IP Address Manager (IPAM) pools allocate IP addresses to AWS resource types within an IPAM policy",
@@ -15635,6 +15866,86 @@
     ],
     "dependentActions": []
   },
+  "getipamrouteoriginauthorizations": {
+    "name": "GetIpamRouteOriginAuthorizations",
+    "description": "Grants permission to retrieve the current Route Origin Authorizations (ROAs) published to the RPKI for an IPAM internet registry association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "getipamrouteprotectionfindings": {
+    "name": "GetIpamRouteProtectionFindings",
+    "description": "Grants permission to retrieve route protection findings for an IPAM",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "getipamroutingpolicyregistrationdeltas": {
+    "name": "GetIpamRoutingPolicyRegistrationDeltas",
+    "description": "Grants permission to retrieve the history of routing policy registration changes for an IPAM internet registry association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
+  "getipamroutingpolicyregistrations": {
+    "name": "GetIpamRoutingPolicyRegistrations",
+    "description": "Grants permission to retrieve routing policy registrations for an IPAM internet registry association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "getlaunchtemplatedata": {
     "name": "GetLaunchTemplateData",
     "description": "Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version",
@@ -16506,6 +16817,16 @@
     ],
     "dependentActions": []
   },
+  "modifyaccountvpcencryptioncontrol": {
+    "name": "ModifyAccountVpcEncryptionControl",
+    "description": "Grants permission to modify the account-level VPC Encryption Control configuration",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "modifyaddressattribute": {
     "name": "ModifyAddressAttribute",
     "description": "Grants permission to modify an attribute of the specified Elastic IP address",
@@ -17544,6 +17865,28 @@
     ],
     "dependentActions": []
   },
+  "modifyipamroutingpolicyregistration": {
+    "name": "ModifyIpamRoutingPolicyRegistration",
+    "description": "Grants permission to modify an existing routing policy registration",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "ipam-internet-registry-association",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "ec2:Attribute",
+          "ec2:Attribute/${AttributeName}",
+          "ec2:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "ec2:Region"
+    ],
+    "dependentActions": []
+  },
   "modifyipamscope": {
     "name": "ModifyIpamScope",
     "description": "Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) scope",

package/data/actions/guardduty.json

@@ -23,6 +23,25 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createcustomdetectionruleassociation": {
+    "name": "CreateCustomDetectionRuleAssociation",
+    "description": "Grants permission to create a GuardDuty custom detection rule association",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
+    "dependentActions": []
+  },
+  "createcustomdetectionruleorgconfiguration": {
+    "name": "CreateCustomDetectionRuleOrgConfiguration",
+    "description": "Grants permission to create the organization configuration for a GuardDuty custom detection rule",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createdetector": {
     "name": "CreateDetector",
     "description": "Grants permission to create a detector",
@@ -155,6 +174,29 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletecustomdetectionruleassociation": {
+    "name": "DeleteCustomDetectionRuleAssociation",
+    "description": "Grants permission to delete a GuardDuty custom detection rule association",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletecustomdetectionruleorgconfiguration": {
+    "name": "DeleteCustomDetectionRuleOrgConfiguration",
+    "description": "Grants permission to delete the organization configuration for a GuardDuty custom detection rule",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletedetector": {
     "name": "DeleteDetector",
     "description": "Grants permission to delete GuardDuty detectors",
@@ -385,6 +427,44 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getcustomdetectionrule": {
+    "name": "GetCustomDetectionRule",
+    "description": "Grants permission to retrieve a GuardDuty custom detection rule",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "customdetectionrule",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcustomdetectionruleassociation": {
+    "name": "GetCustomDetectionRuleAssociation",
+    "description": "Grants permission to retrieve a GuardDuty custom detection rule association",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getcustomdetectionruleorgconfiguration": {
+    "name": "GetCustomDetectionRuleOrgConfiguration",
+    "description": "Grants permission to retrieve the organization configuration for a GuardDuty custom detection rule",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getdetector": {
     "name": "GetDetector",
     "description": "Grants permission to retrieve GuardDuty detectors",
@@ -609,6 +689,30 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listcustomdetectionruleassociations": {
+    "name": "ListCustomDetectionRuleAssociations",
+    "description": "Grants permission to retrieve a list of GuardDuty custom detection rule associations",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcustomdetectionruleorgconfigurations": {
+    "name": "ListCustomDetectionRuleOrgConfigurations",
+    "description": "Grants permission to retrieve a list of organization configurations for GuardDuty custom detection rules",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listcustomdetectionrules": {
+    "name": "ListCustomDetectionRules",
+    "description": "Grants permission to retrieve a list of GuardDuty custom detection rules",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listdetectors": {
     "name": "ListDetectors",
     "description": "Grants permission to retrieve a list of GuardDuty detectors",
@@ -702,6 +806,12 @@
     "description": "Grants permission to retrieve a list of tags associated with a GuardDuty resource",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "detector",
         "required": false,
@@ -823,6 +933,12 @@
     "description": "Grants permission to add tags to a GuardDuty resource",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "detector",
         "required": false,
@@ -891,6 +1007,12 @@
     "description": "Grants permission to remove tags from a GuardDuty resource",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "detector",
         "required": false,
@@ -945,6 +1067,29 @@
     ],
     "dependentActions": []
   },
+  "updatecustomdetectionruleassociation": {
+    "name": "UpdateCustomDetectionRuleAssociation",
+    "description": "Grants permission to update a GuardDuty custom detection rule association",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "customdetectionruleassociation",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "updatecustomdetectionruleorgconfiguration": {
+    "name": "UpdateCustomDetectionRuleOrgConfiguration",
+    "description": "Grants permission to update the organization configuration for a GuardDuty custom detection rule",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updatedetector": {
     "name": "UpdateDetector",
     "description": "Grants permission to update GuardDuty detectors",

package/data/actions/kinesis.json

@@ -30,6 +30,50 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "associatestreamswithchannel": {
+    "name": "AssociateStreamsWithChannel",
+    "description": "Grants permission to associate a stream with a channel",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
+      {
+        "name": "stream",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "createchannel": {
+    "name": "CreateChannel",
+    "description": "Grants permission to create a channel that delivers data from a selected single stream to a destination",
+    "accessLevel": "Tagging, Write",
+    "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "createstream": {
     "name": "CreateStream",
     "description": "Grants permission to create a Amazon Kinesis stream",
@@ -66,6 +110,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "deletechannel": {
+    "name": "DeleteChannel",
+    "description": "Grants permission to delete the specified channel",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deleteresourcepolicy": {
     "name": "DeleteResourcePolicy",
     "description": "Grants permission to delete a resource policy associated with a specified stream or consumer",
@@ -133,6 +194,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "describechannel": {
+    "name": "DescribeChannel",
+    "description": "Grants permission to describe the specified channel",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "describelimits": {
     "name": "DescribeLimits",
     "description": "Grants permission to describe the shard limits and usage for the account",
@@ -284,6 +362,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listchannels": {
+    "name": "ListChannels",
+    "description": "Grants permission to list the channels in the account, optionally filtered by stream",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listshards": {
     "name": "ListShards",
     "description": "Grants permission to list the shards in a stream and provides information about each shard",
@@ -331,6 +417,14 @@
     "description": "Grants permission to list the tags for the specified Amazon Kinesis resource",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "consumer",
         "required": true,
@@ -566,6 +660,16 @@
     "description": "Grants permission to add or update tags for the specified Amazon Kinesis resource. Each resource can have up to 50 tags",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:RequestTag/${TagKey}",
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "consumer",
         "required": true,
@@ -595,6 +699,15 @@
     "description": "Grants permission to remove tags from the specified Kinesis data resource. Removed tags are deleted and cannot be recovered after this operation successfully completes",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}",
+          "aws:TagKeys"
+        ],
+        "dependentActions": []
+      },
       {
         "name": "consumer",
         "required": true,
@@ -625,6 +738,23 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updatechannel": {
+    "name": "UpdateChannel",
+    "description": "Grants permission to update the logging configuration and destination data freshness for the specified channel",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "channel",
+        "required": true,
+        "conditionKeys": [
+          "aws:ResourceTag/${TagKey}"
+        ],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "updatemaxrecordsize": {
     "name": "UpdateMaxRecordSize",
     "description": "Grants permission to update the maximum record size for a Kinesis data stream",

package/data/actions/support.json

@@ -178,7 +178,7 @@
   "downloadattachment": {
     "name": "DownloadAttachment",
     "description": "Grants permission to get a presigned URL to download an attachment from an AWS Support case",
-    "accessLevel": "Write",
+    "accessLevel": "Read",
     "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []

package/data/conditionKeys/agent-registry.json

@@ -4,6 +4,11 @@
     "description": "Filters access by the AWS account ID of the principal that created the registry record",
     "type": "String"
   },
+  "agent-registry:recordsourceaccount": {
+    "key": "agent-registry:RecordSourceAccount",
+    "description": "Filters access by the AWS account ID of the source resource associated with a registry record",
+    "type": "String"
+  },
   "aws:requesttag/${tagkey}": {
     "key": "aws:RequestTag/${TagKey}",
     "description": "Filters access by creating requests based on the allowed set of values for each of the mandatory tags",

package/data/resourceTypes/connect.json

@@ -94,6 +94,13 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "extraction-definition": {
+    "key": "extraction-definition",
+    "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/extraction-definition/${ExtractionDefinitionId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "hierarchy-group": {
     "key": "hierarchy-group",
     "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/agent-group/${HierarchyGroupId}",

package/data/resourceTypes/ec2.json

@@ -465,6 +465,19 @@
       "ec2:ResourceTag/${TagKey}"
     ]
   },
+  "ipam-internet-registry-association": {
+    "key": "ipam-internet-registry-association",
+    "arn": "arn:${Partition}:ec2::${Account}:ipam-internet-registry-association/${IpamInternetRegistryAssociationId}",
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys",
+      "ec2:Attribute",
+      "ec2:Attribute/${AttributeName}",
+      "ec2:Region",
+      "ec2:ResourceTag/${TagKey}"
+    ]
+  },
   "ipam-policy": {
     "key": "ipam-policy",
     "arn": "arn:${Partition}:ec2::${Account}:ipam-policy/${IpamPolicyId}",

package/data/resourceTypes/guardduty.json

@@ -1,4 +1,15 @@
 {
+  "customdetectionrule": {
+    "key": "customdetectionrule",
+    "arn": "arn:${Partition}:guardduty::aws:detection-rule/custom/${RuleId}"
+  },
+  "customdetectionruleassociation": {
+    "key": "customdetectionruleassociation",
+    "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detection-rule/custom/${RuleId}/association/${AssociationId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "detector": {
     "key": "detector",
     "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}",

package/data/resourceTypes/kinesis.json

@@ -1,4 +1,11 @@
 {
+  "channel": {
+    "key": "channel",
+    "arn": "arn:${Partition}:kinesis:${Region}:${Account}:channel/${ChannelId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "consumer": {
     "key": "consumer",
     "arn": "arn:${Partition}:kinesis:${Region}:${Account}:${StreamType}/${StreamName}/consumer/${ConsumerName}:${ConsumerCreationTimpstamp}",

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.21.202608304",
+  "version": "0.21.202609021",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/act-security-labs/iam-data.git"
   },
-  "updatedAt": "2026-08-30T04:45:34.657Z",
+  "updatedAt": "2026-09-02T04:46:37.958Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",
@@ -34,11 +34,11 @@
   "author": "David Kerber <dave@cloudcopilot.io>",
   "license": "MIT",
   "devDependencies": {
-    "@cloud-copilot/prettier-config": "^0.1.1",
+    "@actsecurity/prettier-config": "^0.1.1",
     "@types/node": "^22.5.0",
     "@vitest/coverage-v8": "^4.0.18",
     "typescript": "^5.5.4",
     "vitest": "^4.0.18"
   },
-  "prettier": "@cloud-copilot/prettier-config"
+  "prettier": "@actsecurity/prettier-config"
 }