@cloud-copilot/iam-data 0.9.202411251 → 0.9.202412071

package/data/actions/vpce.json

@@ -0,0 +1,11 @@
+{
+  "allowmultiregion": {
+    "name": "AllowMultiRegion",
+    "isPermissionOnly": true,
+    "description": "Grants permission to manage multi-region VPC endpoints and VPC endpoint service configurations",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  }
+}

package/data/conditionKeys/aiops.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/bedrock.json

@@ -19,6 +19,11 @@
     "description": "Filters access by the specified inference profile",
     "type": "ARN"
   },
+  "bedrock:promptrouterarn": {
+    "key": "bedrock:PromptRouterArn",
+    "description": "Filters access by the specified prompt router",
+    "type": "ARN"
+  },
   "bedrock:thirdpartyknowledgebasecredentialssecretarn": {
     "key": "bedrock:ThirdPartyKnowledgeBaseCredentialsSecretArn",
     "description": "Filters access by the secretArn containing the credentials of the third party platform",

package/data/conditionKeys/config.json

@@ -13,5 +13,10 @@
     "key": "aws:TagKeys",
     "description": "Filters access by the presence of mandatory tags in the request",
     "type": "ArrayOfString"
+  },
+  "config:configurationrecorderserviceprincipal": {
+    "key": "config:ConfigurationRecorderServicePrincipal",
+    "description": "Filters access by service principal of the configuration recorder",
+    "type": "String"
   }
 }

package/data/conditionKeys/dsql.json

@@ -0,0 +1,22 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by a tag key and value pair that is allowed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by a list of tag keys that are allowed in the request",
+    "type": "ArrayOfString"
+  },
+  "dsql:witnessregion": {
+    "key": "dsql:WitnessRegion",
+    "description": "Filters access by the witness region of linked clusters",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/eks.json

@@ -29,6 +29,11 @@
     "description": "Filters access by the authenticationMode present in the create / update cluster request",
     "type": "String"
   },
+  "eks:blockstorageenabled": {
+    "key": "eks:blockStorageEnabled",
+    "description": "Filters access by the block storage enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
   "eks:bootstrapclustercreatoradminpermissions": {
     "key": "eks:bootstrapClusterCreatorAdminPermissions",
     "description": "Filters access by the bootstrapClusterCreatorAdminPermissions present in the create cluster request",
@@ -49,6 +54,16 @@
     "description": "Filters access by the clusterName present in the access entry requests the user makes to the EKS service",
     "type": "String"
   },
+  "eks:computeconfigenabled": {
+    "key": "eks:computeConfigEnabled",
+    "description": "Filters access by the compute config enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
+  "eks:elasticloadbalancingenabled": {
+    "key": "eks:elasticLoadBalancingEnabled",
+    "description": "Filters access by the elastic load balancing enabled parameter in the create / update cluster request",
+    "type": "Bool"
+  },
   "eks:issuerurl": {
     "key": "eks:issuerUrl",
     "description": "Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service",

package/data/conditionKeys/invoicing.json

@@ -1 +1,17 @@
-{}
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by allowed set of values for each of the tags",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by tag-value associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by presence of mandatory tags in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/networkflowmonitor.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tag key-value pairs attached to the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/networkmanager.json

@@ -19,6 +19,16 @@
     "description": "Filters access by which customer gateways can be associated or disassociated",
     "type": "ARN"
   },
+  "networkmanager:directconnectgatewayarn": {
+    "key": "networkmanager:directConnectGatewayArn",
+    "description": "Filters access by which Direct Connect gateway can be used to a create/update attachment",
+    "type": "ARN"
+  },
+  "networkmanager:edgelocations": {
+    "key": "networkmanager:edgeLocations",
+    "description": "Filters access by which edge locations can be added or removed from a Direct Connect gateway attachment",
+    "type": "ArrayOfString"
+  },
   "networkmanager:subnetarns": {
     "key": "networkmanager:subnetArns",
     "description": "Filters access by which VPC subnets can be added or removed from a VPC attachment",

package/data/conditionKeys/observabilityadmin.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/redshift-data.json

@@ -4,6 +4,11 @@
     "description": "Filters access by tag-value associated with the resource",
     "type": "String"
   },
+  "redshift-data:glue-catalog-arn": {
+    "key": "redshift-data:glue-catalog-arn",
+    "description": "Filters access by glue catalog arn",
+    "type": "ARN"
+  },
   "redshift-data:session-owner-iam-userid": {
     "key": "redshift-data:session-owner-iam-userid",
     "description": "Filters access by session owner iam userid",

package/data/conditionKeys/redshift-serverless.json

@@ -19,6 +19,11 @@
     "description": "Filters access by the endpoint access identifier",
     "type": "String"
   },
+  "redshift-serverless:managedworkgroupname": {
+    "key": "redshift-serverless:managedWorkgroupName",
+    "description": "Filters access by the managed workgroup identifier",
+    "type": "String"
+  },
   "redshift-serverless:namespaceid": {
     "key": "redshift-serverless:namespaceId",
     "description": "Filters access by the namespace identifier",

package/data/conditionKeys/s3express.json

@@ -1,4 +1,9 @@
 {
+  "s3express:allaccessrestrictedtolocalzonegroup": {
+    "key": "s3express:AllAccessRestrictedToLocalZoneGroup",
+    "description": "Filters all access to the bucket unless the request originates from the AWS Local Zone network border group(s) provided in this condition key",
+    "type": "String"
+  },
   "s3express:locationname": {
     "key": "s3express:LocationName",
     "description": "Filters access by a specific Availability Zone ID",

package/data/conditionKeys/s3tables.json

@@ -0,0 +1,12 @@
+{
+  "s3tables:namespace": {
+    "key": "s3tables:namespace",
+    "description": "Filters access by the namespaces created in the table bucket",
+    "type": "String"
+  },
+  "s3tables:tablename": {
+    "key": "s3tables:tableName",
+    "description": "Filters access by the name of the tables in the table bucket",
+    "type": "String"
+  }
+}

package/data/conditionKeys/sagemaker-data-science-assistant.json

@@ -0,0 +1 @@
+{}

package/data/conditionKeys/security-ir.json

@@ -0,0 +1,17 @@
+{
+  "aws:requesttag/${tagkey}": {
+    "key": "aws:RequestTag/${TagKey}",
+    "description": "Filters access by the tags that are passed in the request",
+    "type": "String"
+  },
+  "aws:resourcetag/${tagkey}": {
+    "key": "aws:ResourceTag/${TagKey}",
+    "description": "Filters access by the tags associated with the resource",
+    "type": "String"
+  },
+  "aws:tagkeys": {
+    "key": "aws:TagKeys",
+    "description": "Filters access by the tag keys that are passed in the request",
+    "type": "ArrayOfString"
+  }
+}

package/data/conditionKeys/vpc-lattice.json

@@ -24,6 +24,11 @@
     "description": "Filters access by the protocol specified in the request",
     "type": "String"
   },
+  "vpc-lattice:resourceconfigurationarn": {
+    "key": "vpc-lattice:ResourceConfigurationArn",
+    "description": "Filters access by the ARN of a resource configuration",
+    "type": "ARN"
+  },
   "vpc-lattice:securitygroupids": {
     "key": "vpc-lattice:SecurityGroupIds",
     "description": "Filters access by the IDs of security groups",
@@ -44,6 +49,11 @@
     "description": "Filters access by the ARNs of target groups",
     "type": "ArrayOfARN"
   },
+  "vpc-lattice:vpcendpointid": {
+    "key": "vpc-lattice:VpcEndpointId",
+    "description": "Filters access by the ID of a VPC endpoint",
+    "type": "String"
+  },
   "vpc-lattice:vpcid": {
     "key": "vpc-lattice:VpcId",
     "description": "Filters access by the ID of a virtual private cloud (VPC)",

package/data/conditionKeys/vpce.json

@@ -0,0 +1 @@
+{}

package/data/resourceTypes/aiops.json

@@ -0,0 +1,9 @@
+{
+  "investigation-group": {
+    "key": "investigation-group",
+    "arn": "arn:${Partition}:aiops:${Region}:${Account}:investigation-group/${InvestigationGroupId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}

package/data/resourceTypes/bedrock.json

@@ -3,10 +3,21 @@
     "key": "foundation-model",
     "arn": "arn:${Partition}:bedrock:${Region}::foundation-model/${ResourceId}"
   },
+  "async-invoke": {
+    "key": "async-invoke",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:async-invoke/${ResourceId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "inference-profile": {
     "key": "inference-profile",
     "arn": "arn:${Partition}:bedrock:${Region}:${Account}:inference-profile/${ResourceId}"
   },
+  "default-prompt-router": {
+    "key": "default-prompt-router",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:default-prompt-router/${ResourceId}"
+  },
   "application-inference-profile": {
     "key": "application-inference-profile",
     "arn": "arn:${Partition}:bedrock:${Region}:${Account}:application-inference-profile/${ResourceId}",
@@ -132,5 +143,21 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "bedrock-marketplace-model-endpoint": {
+    "key": "bedrock-marketplace-model-endpoint",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:marketplace/model-endpoint/all-access"
+  },
+  "data-automation-project": {
+    "key": "data-automation-project",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-project/${ProjectId}"
+  },
+  "blueprint": {
+    "key": "blueprint",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:blueprint/${BlueprintId}"
+  },
+  "data-automation-invocation-job": {
+    "key": "data-automation-invocation-job",
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-invocation/${JobId}"
   }
 }

package/data/resourceTypes/config.json

@@ -51,5 +51,12 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "configurationrecorder": {
+    "key": "ConfigurationRecorder",
+    "arn": "arn:${Partition}:config:${Region}:${Account}:configuration-recorder/${RecorderName}/${RecorderId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/dsql.json

@@ -0,0 +1,9 @@
+{
+  "cluster": {
+    "key": "Cluster",
+    "arn": "arn:${Partition}:dsql:${Region}:${Account}:cluster/${Identifier}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}

package/data/resourceTypes/es.json

@@ -26,5 +26,12 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "datasource": {
+    "key": "datasource",
+    "arn": "arn:${Partition}:opensearch:${Region}:${Account}:datasource/${DataSourceName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/invoicing.json

@@ -1 +1,9 @@
-{}
+{
+  "invoice-unit": {
+    "key": "invoice-unit",
+    "arn": "arn:${Partition}:invoicing::${Account}:invoice-unit/${Identifier}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}

package/data/resourceTypes/memorydb.json

@@ -1,4 +1,8 @@
 {
+  "multiregionparametergroup": {
+    "key": "multiregionparametergroup",
+    "arn": "arn:${Partition}:memorydb::${Account}:multiregionparametergroup/${MultiRegionParameterGroupName}"
+  },
   "parametergroup": {
     "key": "parametergroup",
     "arn": "arn:${Partition}:memorydb:${Region}:${Account}:parametergroup/${ParameterGroupName}",
@@ -13,6 +17,14 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "multiregioncluster": {
+    "key": "multiregioncluster",
+    "arn": "arn:${Partition}:memorydb::${Account}:multiregioncluster/${ClusterName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "memorydb:TLSEnabled"
+    ]
+  },
   "cluster": {
     "key": "cluster",
     "arn": "arn:${Partition}:memorydb:${Region}:${Account}:cluster/${ClusterName}",

package/data/resourceTypes/networkflowmonitor.json

@@ -0,0 +1,16 @@
+{
+  "monitor": {
+    "key": "monitor",
+    "arn": "arn:${Partition}:networkflowmonitor:${Region}:${Account}:monitor/${MonitorName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "scope": {
+    "key": "scope",
+    "arn": "arn:${Partition}:networkflowmonitor:${Region}:${Account}:scope/${ScopeId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}

package/data/resourceTypes/observabilityadmin.json

@@ -0,0 +1 @@
+{}

package/data/resourceTypes/opensearch.json

@@ -2,5 +2,9 @@
   "application": {
     "key": "application",
     "arn": "arn:${Partition}:opensearch:${Region}:${Account}:application/${AppId}"
+  },
+  "datasource": {
+    "key": "datasource",
+    "arn": "arn:${Partition}:opensearch:${Region}:${Account}:datasource/${DataSourceName}"
   }
 }

package/data/resourceTypes/partnercentral.json

@@ -1,4 +1,8 @@
 {
+  "engagement": {
+    "key": "Engagement",
+    "arn": "arn:${Partition}:partnercentral:${Region}::catalog/${Catalog}/engagement/${Identifier}"
+  },
   "engagement-by-accepting-invitation-task": {
     "key": "engagement-by-accepting-invitation-task",
     "arn": "arn:${Partition}:partnercentral:${Region}::catalog/${Catalog}/engagement-by-accepting-invitation-task/${TaskId}"
@@ -15,6 +19,14 @@
     "key": "Opportunity",
     "arn": "arn:${Partition}:partnercentral:${Region}:${Account}:catalog/${Catalog}/opportunity/${Identifier}"
   },
+  "resource-snapshot-job": {
+    "key": "resource-snapshot-job",
+    "arn": "arn:${Partition}:partnercentral:${Region}:${Account}:catalog/${Catalog}/resource-snapshot-job/${Identifier}"
+  },
+  "resourcesnapshot": {
+    "key": "ResourceSnapshot",
+    "arn": "arn:${Partition}:partnercentral:${Region}:${Account}:catalog/${Catalog}/engagement/${EngagementIdentifier}/resource/${ResourceType}/${ResourceIdentifier}/template/${TemplateIdentifier}/resource-snapshot/${SnapshotRevision}"
+  },
   "solution": {
     "key": "Solution",
     "arn": "arn:${Partition}:partnercentral:${Region}:${Account}:catalog/${Catalog}/solution/${Identifier}"

package/data/resourceTypes/personalize.json

@@ -5,7 +5,7 @@
   },
   "featuretransformation": {
     "key": "featureTransformation",
-    "arn": "arn:${Partition}:personalize:${Region}:${Account}:feature-transformation/${ResourceId}"
+    "arn": "arn:${Partition}:personalize:::feature-transformation/${ResourceId}"
   },
   "dataset": {
     "key": "dataset",
@@ -45,11 +45,11 @@
   },
   "recipe": {
     "key": "recipe",
-    "arn": "arn:${Partition}:personalize:${Region}:${Account}:recipe/${ResourceId}"
+    "arn": "arn:${Partition}:personalize:::recipe/${ResourceId}"
   },
   "algorithm": {
     "key": "algorithm",
-    "arn": "arn:${Partition}:personalize:${Region}:${Account}:algorithm/${ResourceId}"
+    "arn": "arn:${Partition}:personalize:::algorithm/${ResourceId}"
   },
   "batchinferencejob": {
     "key": "batchInferenceJob",

package/data/resourceTypes/qbusiness.json

@@ -6,6 +6,13 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "integration": {
+    "key": "integration",
+    "arn": "arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/integration/${IntegrationId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
   "retriever": {
     "key": "retriever",
     "arn": "arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/retriever/${RetrieverId}",
@@ -48,5 +55,12 @@
   "subscription": {
     "key": "subscription",
     "arn": "arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/subscription/${SubscriptionId}"
+  },
+  "data-accessor": {
+    "key": "data-accessor",
+    "arn": "arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/data-accessor/${DataAccessorId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/redshift-data.json

@@ -12,5 +12,9 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "managed-workgroup": {
+    "key": "managed-workgroup",
+    "arn": "arn:${Partition}:redshift-serverless:${Region}:${Account}:managed-workgroup/${ManagedWorkgroupId}"
   }
 }

package/data/resourceTypes/redshift-serverless.json

@@ -20,6 +20,10 @@
       "aws:ResourceTag/${TagKey}"
     ]
   },
+  "managed-workgroup": {
+    "key": "managed-workgroup",
+    "arn": "arn:${Partition}:redshift-serverless:${Region}:${Account}:managed-workgroup/${ManagedWorkgroupName}"
+  },
   "recoverypoint": {
     "key": "recoveryPoint",
     "arn": "arn:${Partition}:redshift-serverless:${Region}:${Account}:recoverypoint/${RecoveryPointId}",

package/data/resourceTypes/rekognition.json

@@ -15,7 +15,10 @@
   },
   "project": {
     "key": "project",
-    "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/${CreationTimestamp}"
+    "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/${CreationTimestamp}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "projectversion": {
     "key": "projectversion",
@@ -26,6 +29,9 @@
   },
   "dataset": {
     "key": "dataset",
-    "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/dataset/${DatasetType}/${CreationTimestamp}"
+    "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/dataset/${DatasetType}/${CreationTimestamp}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/s3tables.json

@@ -0,0 +1,14 @@
+{
+  "tablebucket": {
+    "key": "TableBucket",
+    "arn": "arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}"
+  },
+  "table": {
+    "key": "Table",
+    "arn": "arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}/table/${TableID}",
+    "conditionKeys": [
+      "s3tables:namespace",
+      "s3tables:tableName"
+    ]
+  }
+}

package/data/resourceTypes/sagemaker-data-science-assistant.json

@@ -0,0 +1 @@
+{}

package/data/resourceTypes/sagemaker.json

@@ -227,6 +227,22 @@
       "sagemaker:ResourceTag/${TagKey}"
     ]
   },
+  "training-plan": {
+    "key": "training-plan",
+    "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:training-plan/${TrainingPlanName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "sagemaker:ResourceTag/${TagKey}"
+    ]
+  },
+  "reserved-capacity": {
+    "key": "reserved-capacity",
+    "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:reserved-capacity/${RandomString}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "sagemaker:ResourceTag/${TagKey}"
+    ]
+  },
   "project": {
     "key": "project",
     "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:project/${ProjectName}",
@@ -471,6 +487,22 @@
       "sagemaker:ResourceTag/${TagKey}"
     ]
   },
+  "compute-quota": {
+    "key": "compute-quota",
+    "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:compute-quota/${ComputeQuotaId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "sagemaker:ResourceTag/${TagKey}"
+    ]
+  },
+  "cluster-scheduler-config": {
+    "key": "cluster-scheduler-config",
+    "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:cluster-scheduler-config/${ClusterSchedulerConfigId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}",
+      "sagemaker:ResourceTag/${TagKey}"
+    ]
+  },
   "partner-app": {
     "key": "partner-app",
     "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:partner-app/${AppId}",

package/data/resourceTypes/security-ir.json

@@ -0,0 +1,16 @@
+{
+  "case": {
+    "key": "case",
+    "arn": "arn:${Partition}:security-ir:${Region}:${Account}:case/${CaseId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  },
+  "membership": {
+    "key": "membership",
+    "arn": "arn:${Partition}:security-ir:${Region}:${Account}:membership/${MembershipId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
+  }
+}

package/data/resourceTypes/transfer.json

@@ -54,5 +54,12 @@
     "conditionKeys": [
       "aws:ResourceTag/${TagKey}"
     ]
+  },
+  "webapp": {
+    "key": "webapp",
+    "arn": "arn:${Partition}:transfer:${Region}:${Account}:webapp/${WebAppId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }