@cloud-copilot/iam-data 0.21.202609301 → 0.21.202610021

package/data/actions/account.json

@@ -325,6 +325,27 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "sendphonenumberverification": {
+    "name": "SendPhoneNumberVerification",
+    "description": "Grants permission to send a verification code to the primary contact phone number for an account",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "account",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "accountInOrganization",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "startprimaryemailupdate": {
     "name": "StartPrimaryEmailUpdate",
     "description": "Grants permission to start the process to update the primary email address of an account",
@@ -341,5 +362,26 @@
       "account:EmailTargetDomain"
     ],
     "dependentActions": []
+  },
+  "verifyphonenumber": {
+    "name": "VerifyPhoneNumber",
+    "description": "Grants permission to verify the primary contact phone number for an account by submitting a verification code",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "account",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "accountInOrganization",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
   }
 }

package/data/actions/aidevops.json

@@ -1050,7 +1050,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aidevops:SourceAgentSpaceArn",
+      "aidevops:TargetAgentSpaceArn"
+    ],
     "dependentActions": []
   },
   "tagresource": {
@@ -1230,7 +1233,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aidevops:SourceAgentSpaceArn",
+      "aidevops:TargetAgentSpaceArn"
+    ],
     "dependentActions": []
   },
   "updategoal": {

package/data/actions/aws-external-anthropic.json

@@ -293,18 +293,9 @@
   },
   "createuserprofile": {
     "name": "CreateUserProfile",
-    "description": "Grants permission to create a user profile in a workspace",
+    "description": "Grants permission to create a user profile",
     "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "workspace",
-        "required": true,
-        "conditionKeys": [
-          "aws:ResourceTag/${TagKey}"
-        ],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -312,16 +303,7 @@
     "name": "CreateUserProfileEnrollmentUrl",
     "description": "Grants permission to create an enrollment URL for a user profile",
     "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "workspace",
-        "required": true,
-        "conditionKeys": [
-          "aws:ResourceTag/${TagKey}"
-        ],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -675,16 +657,7 @@
     "name": "GetUserProfile",
     "description": "Grants permission to retrieve details of a user profile",
     "accessLevel": "Read",
-    "resourceTypes": [
-      {
-        "name": "workspace",
-        "required": true,
-        "conditionKeys": [
-          "aws:ResourceTag/${TagKey}"
-        ],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -902,18 +875,9 @@
   },
   "listuserprofiles": {
     "name": "ListUserProfiles",
-    "description": "Grants permission to list user profiles in a workspace",
+    "description": "Grants permission to list user profiles",
     "accessLevel": "List",
-    "resourceTypes": [
-      {
-        "name": "workspace",
-        "required": true,
-        "conditionKeys": [
-          "aws:ResourceTag/${TagKey}"
-        ],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -1135,18 +1099,9 @@
   },
   "updateuserprofile": {
     "name": "UpdateUserProfile",
-    "description": "Grants permission to update a user profile in a workspace",
+    "description": "Grants permission to update a user profile",
     "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "workspace",
-        "required": true,
-        "conditionKeys": [
-          "aws:ResourceTag/${TagKey}"
-        ],
-        "dependentActions": []
-      }
-    ],
+    "resourceTypes": [],
     "conditionKeys": [],
     "dependentActions": []
   },

package/data/actions/billing.json

@@ -297,6 +297,22 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listbusinesssupportaccountcharges": {
+    "name": "ListBusinessSupportAccountCharges",
+    "description": "Grants permission to view Business Support charges broken down by linked account",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listbusinesssupportsubscriptionhistory": {
+    "name": "ListBusinessSupportSubscriptionHistory",
+    "description": "Grants permission to view Business Support subscription contract history",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listenterprisesupportlinkedaccountcharges": {
     "name": "ListEnterpriseSupportLinkedAccountCharges",
     "description": "Grants permission to view Enterprise Support charges broken down by linked account",

package/data/actions/cloudwatch.json

@@ -100,6 +100,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "updateotelenrichment": {
+    "name": "UpdateOTelEnrichment",
+    "description": "Grants permission to update the metric filters of OTel Enrichment of vended metrics for PromQL querying",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "assumeaccessprofile": {
     "name": "AssumeAccessProfile",
     "description": "Grants permission to assume an access profile",
@@ -235,6 +243,16 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "createresourcemetricsconfiguration": {
+    "name": "CreateResourceMetricsConfiguration",
+    "description": "Grants permission to create a resource metrics configuration that enables detailed monitoring for a resource",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "cloudwatch:ResourceArn"
+    ],
+    "dependentActions": []
+  },
   "createservicelevelobjective": {
     "name": "CreateServiceLevelObjective",
     "description": "Grants permission to create a service level objective",
@@ -504,6 +522,16 @@
     ],
     "dependentActions": []
   },
+  "deleteresourcemetricsconfiguration": {
+    "name": "DeleteResourceMetricsConfiguration",
+    "description": "Grants permission to delete a resource metrics configuration and disable detailed monitoring for a resource",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "cloudwatch:ResourceArn"
+    ],
+    "dependentActions": []
+  },
   "deleteservicelevelobjective": {
     "name": "DeleteServiceLevelObjective",
     "description": "Grants permission to delete a service level objective",
@@ -1008,6 +1036,16 @@
     ],
     "dependentActions": []
   },
+  "getresourcemetricsconfiguration": {
+    "name": "GetResourceMetricsConfiguration",
+    "description": "Grants permission to retrieve the resource metrics configuration and detailed monitoring status for a resource",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "cloudwatch:ResourceArn"
+    ],
+    "dependentActions": []
+  },
   "getservice": {
     "name": "GetService",
     "description": "Grants permission to retrieve information about a service",
@@ -2249,6 +2287,16 @@
     ],
     "dependentActions": []
   },
+  "updateresourcemetricsconfiguration": {
+    "name": "UpdateResourceMetricsConfiguration",
+    "description": "Grants permission to update the resource metrics configuration for a resource",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [
+      "cloudwatch:ResourceArn"
+    ],
+    "dependentActions": []
+  },
   "updateservicelevelobjective": {
     "name": "UpdateServiceLevelObjective",
     "description": "Grants permission to update a service level objective",

package/data/actions/lambda.json

@@ -56,6 +56,23 @@
     ],
     "dependentActions": []
   },
+  "invokewebfunctionendpoint": {
+    "name": "InvokeWebFunctionEndpoint",
+    "description": "Grants permission to invoke a Lambda web function endpoint via HTTP",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunctionEndpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "lambda:Resource/WebFunctionAuthType"
+    ],
+    "dependentActions": []
+  },
   "passcapacityprovider": {
     "name": "PassCapacityProvider",
     "description": "Grants permission to pass an AWS Lambda capacity provider to a service",
@@ -287,6 +304,57 @@
     ],
     "dependentActions": []
   },
+  "createwebfunction": {
+    "name": "CreateWebFunction",
+    "description": "Grants permission to create a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys",
+      "lambda:Request/WebFunctionAuthType"
+    ],
+    "dependentActions": []
+  },
+  "createwebfunctionendpoint": {
+    "name": "CreateWebFunctionEndpoint",
+    "description": "Grants permission to create an endpoint for a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "lambda:Request/WebFunctionAuthType"
+    ],
+    "dependentActions": []
+  },
+  "createwebfunctionrevision": {
+    "name": "CreateWebFunctionRevision",
+    "description": "Grants permission to create a revision for a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "deletealias": {
     "name": "DeleteAlias",
     "description": "Grants permission to delete an AWS Lambda function alias",
@@ -510,7 +578,7 @@
   },
   "deleteresourcepolicy": {
     "name": "DeleteResourcePolicy",
-    "description": "Grants permission to detach a policy from an AWS Lambda resource",
+    "description": "Grants permission to detach a policy from an AWS Lambda resource, additionally requiring lambda:RemovePermission only for a function resource",
     "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
@@ -518,6 +586,12 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -525,6 +599,53 @@
     ],
     "dependentActions": []
   },
+  "deletewebfunction": {
+    "name": "DeleteWebFunction",
+    "description": "Grants permission to delete a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "deletewebfunctionendpoint": {
+    "name": "DeleteWebFunctionEndpoint",
+    "description": "Grants permission to delete an endpoint for a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunctionEndpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "lambda:Resource/WebFunctionAuthType"
+    ],
+    "dependentActions": []
+  },
+  "deletewebfunctionrevision": {
+    "name": "DeleteWebFunctionRevision",
+    "description": "Grants permission to delete a revision for a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunctionRevision",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getaccountsettings": {
     "name": "GetAccountSettings",
     "description": "Grants permission to view details about an account's limits and usage in an AWS Region",
@@ -906,7 +1027,7 @@
   },
   "getresourcepolicy": {
     "name": "GetResourcePolicy",
-    "description": "Grants permission to view a policy for an AWS Lambda resource",
+    "description": "Grants permission to view a policy for an AWS Lambda resource, additionally requiring lambda:GetPolicy only for a function resource",
     "accessLevel": "Read",
     "resourceTypes": [
       {
@@ -914,6 +1035,12 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -934,6 +1061,61 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getwebaccountsettings": {
+    "name": "GetWebAccountSettings",
+    "description": "Grants permission to view the account settings",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getwebfunction": {
+    "name": "GetWebFunction",
+    "description": "Grants permission to view details about a Lambda web function",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getwebfunctionendpoint": {
+    "name": "GetWebFunctionEndpoint",
+    "description": "Grants permission to view details about an endpoint for a Lambda web function",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "webFunctionEndpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "lambda:Resource/WebFunctionAuthType"
+    ],
+    "dependentActions": []
+  },
+  "getwebfunctionrevision": {
+    "name": "GetWebFunctionRevision",
+    "description": "Grants permission to view details about a revision for a Lambda web function",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "webFunctionRevision",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "invokeasync": {
     "name": "InvokeAsync",
     "description": "Grants permission to invoke a function asynchronously (Deprecated)",
@@ -1201,7 +1383,7 @@
   },
   "listtags": {
     "name": "ListTags",
-    "description": "Grants permission to retrieve a list of tags for an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource",
+    "description": "Grants permission to retrieve a list of tags for an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector, MicroVM image resource, or a web function resource",
     "accessLevel": "Read",
     "resourceTypes": [
       {
@@ -1239,6 +1421,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -1259,6 +1447,44 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listwebfunctionendpoints": {
+    "name": "ListWebFunctionEndpoints",
+    "description": "Grants permission to retrieve a list of endpoints for a Lambda web function",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listwebfunctionrevisions": {
+    "name": "ListWebFunctionRevisions",
+    "description": "Grants permission to retrieve a list of revisions for a Lambda web function",
+    "accessLevel": "List",
+    "resourceTypes": [
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listwebfunctions": {
+    "name": "ListWebFunctions",
+    "description": "Grants permission to retrieve a list of Lambda web functions",
+    "accessLevel": "List",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "publishlayerversion": {
     "name": "PublishLayerVersion",
     "description": "Grants permission to create an AWS Lambda layer",
@@ -1395,7 +1621,7 @@
   },
   "putresourcepolicy": {
     "name": "PutResourcePolicy",
-    "description": "Grants permission to attach a policy to an AWS Lambda resource",
+    "description": "Grants permission to attach a policy to an AWS Lambda resource, additionally requiring lambda:AddPermission and lambda:RemovePermission only for a function resource",
     "accessLevel": "Permissions management, Write",
     "resourceTypes": [
       {
@@ -1403,6 +1629,12 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -1565,7 +1797,7 @@
   },
   "tagresource": {
     "name": "TagResource",
-    "description": "Grants permission to add tags to an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource",
+    "description": "Grants permission to add tags to an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector, MicroVM image resource, or a web function resource",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
@@ -1603,6 +1835,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -1628,7 +1866,7 @@
   },
   "untagresource": {
     "name": "UntagResource",
-    "description": "Grants permission to remove tags from an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector or MicroVM image resource",
+    "description": "Grants permission to remove tags from an AWS Lambda function, event source mapping, capacity provider, code signing configuration, network connector, MicroVM image resource, or a web function resource",
     "accessLevel": "Tagging, Write",
     "resourceTypes": [
       {
@@ -1666,6 +1904,12 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "webFunction",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -1868,5 +2112,23 @@
     ],
     "conditionKeys": [],
     "dependentActions": []
+  },
+  "updatewebfunctionendpoint": {
+    "name": "UpdateWebFunctionEndpoint",
+    "description": "Grants permission to update an endpoint for a Lambda web function",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "webFunctionEndpoint",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "lambda:Request/WebFunctionAuthType",
+      "lambda:Resource/WebFunctionAuthType"
+    ],
+    "dependentActions": []
   }
 }

package/data/actions/s3vectors.json

@@ -255,6 +255,24 @@
     ],
     "dependentActions": []
   },
+  "putvectorbucketdefaultindexmode": {
+    "name": "PutVectorBucketDefaultIndexMode",
+    "description": "Grants permission to update the default index mode for a specified vector bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "VectorBucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
+  },
   "putvectorbucketpolicy": {
     "name": "PutVectorBucketPolicy",
     "description": "Grants permission to add an IAM resource policy to a specified vector bucket",
@@ -359,5 +377,23 @@
       "s3vectors:VectorBucketTag/${TagKey}"
     ],
     "dependentActions": []
+  },
+  "updateindexmode": {
+    "name": "UpdateIndexMode",
+    "description": "Grants permission to update the index mode for a specified vector index",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Index",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "s3vectors:VectorBucketTag/${TagKey}"
+    ],
+    "dependentActions": []
   }
 }

package/data/actions/security-ir.json

@@ -140,6 +140,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getfindingmetrics": {
+    "name": "GetFindingMetrics",
+    "description": "Grants permission to retrieve finding-lifecycle metrics for a membership over a date range",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "membership",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getmembership": {
     "name": "GetMembership",
     "description": "Grants permission to get a membership",

package/data/actions/ssm.json

@@ -439,25 +439,7 @@
     "resourceTypes": [
       {
         "name": "association",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "document",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "instance",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "managed-instance",
-        "required": false,
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -736,25 +718,7 @@
     "resourceTypes": [
       {
         "name": "association",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "document",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "instance",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "managed-instance",
-        "required": false,
+        "required": true,
         "conditionKeys": [],
         "dependentActions": []
       }

package/data/actions/vpc-lattice.json

@@ -528,9 +528,7 @@
       }
     ],
     "conditionKeys": [
-      "aws:ResourceTag/${TagKey}",
-      "vpc-lattice:ServiceArn",
-      "vpc-lattice:ServiceNetworkArn"
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -799,9 +797,7 @@
       }
     ],
     "conditionKeys": [
-      "aws:ResourceTag/${TagKey}",
-      "vpc-lattice:ServiceArn",
-      "vpc-lattice:ServiceNetworkArn"
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -925,8 +921,7 @@
     "accessLevel": "List",
     "resourceTypes": [],
     "conditionKeys": [
-      "vpc-lattice:ServiceNetworkArn",
-      "vpc-lattice:VpcId"
+      "vpc-lattice:ServiceNetworkArn"
     ],
     "dependentActions": []
   },

package/data/actions/wafv2.json

@@ -1,4 +1,12 @@
 {
+  "describetopcontributorsbyevent": {
+    "name": "DescribeTopContributorsByEvent",
+    "description": "Grants permission to retrieve the top contributors of an event detected by the AWS WAF anti-DDoS managed rule group, used by shield:DescribeAttack",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "disassociatefirewallmanager": {
     "name": "DisassociateFirewallManager",
     "description": "Grants permission to disassociate Firewall Manager from a WebACL",

package/data/conditionKeys/aidevops.json

@@ -2,12 +2,12 @@
   "aidevops:sourceagentspacearn": {
     "key": "aidevops:SourceAgentSpaceArn",
     "description": "Filters access by the source AgentSpace ARN on the request. Set by the service from the request context, not supplied by the caller",
-    "type": "String"
+    "type": "ARN"
   },
   "aidevops:targetagentspacearn": {
     "key": "aidevops:TargetAgentSpaceArn",
     "description": "Filters access by the target AgentSpace ARN on the request. Set by the service from the request context, not supplied by the caller",
-    "type": "String"
+    "type": "ARN"
   },
   "aws:requesttag/${tagkey}": {
     "key": "aws:RequestTag/${TagKey}",

package/data/conditionKeys/cloudwatch.json

@@ -24,6 +24,11 @@
     "description": "Filters access by the presence of access grants associated with the request",
     "type": "String"
   },
+  "cloudwatch:resourcearn": {
+    "key": "cloudwatch:ResourceArn",
+    "description": "Filters access by the ARN of the AWS resource that a resource metrics configuration request targets",
+    "type": "ARN"
+  },
   "cloudwatch:namespace": {
     "key": "cloudwatch:namespace",
     "description": "Filters access by the presence of optional namespace values",

package/data/conditionKeys/elasticache.json

@@ -44,6 +44,11 @@
     "description": "Filters access by the cluster mode parameter present in the request. Default value for single node group (shard) creations is false",
     "type": "Bool"
   },
+  "elasticache:connectiontype": {
+    "key": "elasticache:ConnectionType",
+    "description": "Filters access by the ConnectionType parameter in the request",
+    "type": "String"
+  },
   "elasticache:datastorageunit": {
     "key": "elasticache:DataStorageUnit",
     "description": "Filters access by the CacheUsageLimits.DataStorage.Unit parameter in the CreateServerlessCache and ModifyServerlessCache request",

package/data/conditionKeys/lambda.json

@@ -49,6 +49,16 @@
     "description": "Filters access by restricting the AWS service or account that can invoke a function",
     "type": "String"
   },
+  "lambda:request/webfunctionauthtype": {
+    "key": "lambda:Request/WebFunctionAuthType",
+    "description": "Filters access by the auth type specified in the request. Available during CreateWebFunction, CreateWebFunctionEndpoint, and UpdateWebFunctionEndpoint operations",
+    "type": "String"
+  },
+  "lambda:resource/webfunctionauthtype": {
+    "key": "lambda:Resource/WebFunctionAuthType",
+    "description": "Filters access by the auth type configured on the web function endpoint resource. Available during InvokeWebFunctionEndpoint, UpdateWebFunctionEndpoint, DeleteWebFunctionEndpoint, and GetWebFunctionEndpoint operations",
+    "type": "String"
+  },
   "lambda:securitygroupids": {
     "key": "lambda:SecurityGroupIds",
     "description": "Filters access by the ID of security groups configured for the AWS Lambda function",

package/data/resourceTypes/lambda.json

@@ -69,5 +69,26 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "webfunction": {
+    "key": "webFunction",
+    "arn": "arn:${Partition}:lambda:${Region}:${Account}:web-function/${FunctionName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "webfunctionendpoint": {
+    "key": "webFunctionEndpoint",
+    "arn": "arn:${Partition}:lambda:${Region}:${Account}:web-function/${FunctionName}/endpoint/${EndpointName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "webfunctionrevision": {
+    "key": "webFunctionRevision",
+    "arn": "arn:${Partition}:lambda:${Region}:${Account}:web-function/${FunctionName}/revision/${RevisionId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.21.202609301",
+  "version": "0.21.202610021",
   "description": "AWS IAM Data",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/act-security-labs/iam-data.git"
   },
-  "updatedAt": "2026-09-30T15:41:00.495Z",
+  "updatedAt": "2026-10-02T04:50:27.939Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",