@cloud-copilot/iam-data 0.9.202505201 → 0.9.202505231

package/data/actions/aoss.json

@@ -22,7 +22,9 @@
     "description": "Grants permission to get attributes for one or more collections",
     "accessLevel": "Read",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aoss:collection"
+    ],
     "dependentActions": []
   },
   "batchgeteffectivelifecyclepolicy": {
@@ -67,6 +69,7 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
       "aws:TagKeys"
     ],
     "dependentActions": []

package/data/actions/bedrock.json

@@ -144,7 +144,10 @@
     "description": "Grants permission to create a blueprint for custom output from data automation",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createblueprintversion": {
@@ -174,7 +177,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createdatasource": {
@@ -1713,7 +1719,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "invokeflow": {
@@ -1736,7 +1745,9 @@
     "description": "Grants permission to send user input (text-only) to the inline agent for Bedrock",
     "accessLevel": "Read",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "bedrock:InlineAgentName"
+    ],
     "dependentActions": []
   },
   "invokemodel": {

package/data/actions/cloudwatch.json

@@ -246,6 +246,14 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "generatequeryresultssummary": {
+    "name": "GenerateQueryResultsSummary",
+    "description": "Grants permission to generate a summary of CloudWatch LogInsights query results in natural language using generative AI",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getdashboard": {
     "name": "GetDashboard",
     "description": "Grants permission to display the details of the CloudWatch dashboard you specify",

package/data/actions/connect.json

@@ -3424,7 +3424,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "connect:ListRealtimeContactAnalysisSegmentsByOutputType",
+      "connect:ListRealtimeContactAnalysisSegmentsBySegmentType"
+    ],
     "dependentActions": []
   },
   "listroutingprofilequeues": {

package/data/actions/databrew.json

@@ -21,7 +21,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -32,7 +33,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -43,7 +45,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -54,7 +57,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -65,7 +69,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -76,7 +81,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -87,7 +93,8 @@
     "resourceTypes": [],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },

package/data/actions/dsql.json

@@ -36,25 +36,6 @@
     ],
     "dependentActions": []
   },
-  "createmultiregionclusters": {
-    "name": "CreateMultiRegionClusters",
-    "description": "Grants permission to create multi-Region clusters. Creating multi-Region clusters also requires CreateCluster permission in each specified Region. **This action is deprecated as of 05/09/2025 and will be removed on 05/21/2025.**",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "Cluster",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": [
-          "dsql:CreateCluster"
-        ]
-      }
-    ],
-    "conditionKeys": [
-      "dsql:WitnessRegion"
-    ],
-    "dependentActions": []
-  },
   "dbconnect": {
     "name": "DbConnect",
     "description": "Grants permission to connect to the database",
@@ -100,10 +81,10 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "deletemultiregionclusters": {
-    "name": "DeleteMultiRegionClusters",
-    "description": "Grants permission to delete multi-Region clusters. Deleting multi-Region clusters also requires DeleteCluster permission in each specified Region. **This action is deprecated as of 05/09/2025 and will be removed on 05/21/2025.**",
-    "accessLevel": "Write",
+  "getbackupjob": {
+    "name": "GetBackupJob",
+    "description": "Grants permission to get the status of an Aurora DSQL cluster backup job",
+    "accessLevel": "Read",
     "resourceTypes": [
       {
         "name": "Cluster",
@@ -113,9 +94,7 @@
       }
     ],
     "conditionKeys": [],
-    "dependentActions": [
-      "dsql:DeleteCluster"
-    ]
+    "dependentActions": []
   },
   "getcluster": {
     "name": "GetCluster",
@@ -132,6 +111,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getrestorejob": {
+    "name": "GetRestoreJob",
+    "description": "Grants permission to get the status of an Aurora DSQL cluster restore job",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getvpcendpointservicename": {
     "name": "GetVpcEndpointServiceName",
     "description": "Grants permission to retrieve the VPC endpoint service name for a cluster",
@@ -219,6 +213,69 @@
       "dsql:PutMultiRegionProperties"
     ]
   },
+  "startbackupjob": {
+    "name": "StartBackupJob",
+    "description": "Grants permission to start a backup job for an Aurora DSQL cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "startrestorejob": {
+    "name": "StartRestoreJob",
+    "description": "Grants permission to start a restore job for an Aurora DSQL cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": [
+      "dsql:CreateCluster",
+      "iam:CreateServiceLinkedRole"
+    ]
+  },
+  "stopbackupjob": {
+    "name": "StopBackupJob",
+    "description": "Grants permission to stop a backup job for an Aurora DSQL cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stoprestorejob": {
+    "name": "StopRestoreJob",
+    "description": "Grants permission to stop a restore job for an Aurora DSQL Cluster",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "Cluster",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to add tags to Aurora DSQL resources",

package/data/actions/eks.json

@@ -605,6 +605,36 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "listdashboarddata": {
+    "name": "ListDashboardData",
+    "description": "Grants permission to list dashboard data. The Amazon EKS Dashboard aggregates information about cluster resources across multiple accounts and regions. The dashboard includes information about EC2 Instances and EKS Cluster versions",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dashboard",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "listdashboardresources": {
+    "name": "ListDashboardResources",
+    "description": "Grants permission to list dashboard resources. The Amazon EKS Dashboard aggregates information about cluster resources across multiple accounts and regions. The dashboard includes information about EC2 Instances and EKS Cluster versions",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "dashboard",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "listeksanywheresubscriptions": {
     "name": "ListEksAnywhereSubscriptions",
     "description": "Grants permission to list EKS Anywhere subscriptions",
@@ -705,6 +735,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dashboard",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "eks-anywhere-subscription",
         "required": false,
@@ -794,6 +830,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dashboard",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "eks-anywhere-subscription",
         "required": false,
@@ -854,6 +896,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "dashboard",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "eks-anywhere-subscription",
         "required": false,

package/data/actions/iotfleetwise.json

@@ -20,69 +20,6 @@
     "conditionKeys": [],
     "dependentActions": []
   },
-  "batchcreatevehicle": {
-    "name": "BatchCreateVehicle",
-    "description": "Grants permission to create a batch of vehicles",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "decodermanifest",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": [
-          "iot:CreateThing",
-          "iot:DescribeThing"
-        ]
-      },
-      {
-        "name": "modelmanifest",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "vehicle",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [
-      "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
-    ],
-    "dependentActions": []
-  },
-  "batchupdatevehicle": {
-    "name": "BatchUpdateVehicle",
-    "description": "Grants permission to update a batch of vehicles",
-    "accessLevel": "Write",
-    "resourceTypes": [
-      {
-        "name": "vehicle",
-        "required": true,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "decodermanifest",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      },
-      {
-        "name": "modelmanifest",
-        "required": false,
-        "conditionKeys": [],
-        "dependentActions": []
-      }
-    ],
-    "conditionKeys": [
-      "iotfleetwise:UpdateToModelManifestArn",
-      "iotfleetwise:UpdateToDecoderManifestArn"
-    ],
-    "dependentActions": []
-  },
   "createcampaign": {
     "name": "CreateCampaign",
     "description": "Grants permission to create a campaign",

package/data/actions/medical-imaging.json

@@ -127,6 +127,21 @@
     "conditionKeys": [],
     "dependentActions": []
   },
+  "getdicomseriesmetadata": {
+    "name": "GetDICOMSeriesMetadata",
+    "description": "Grants permission to retrieve metadata for all DICOM instances belonging to a given DICOM series in DICOM JSON format",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "datastore",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getdatastore": {
     "name": "GetDatastore",
     "description": "Grants permission to get data store properties",

package/data/actions/rds.json

@@ -727,7 +727,8 @@
       "aws:TagKeys"
     ],
     "dependentActions": [
-      "iam:PassRole"
+      "iam:PassRole",
+      "rds:AddTagsToResource"
     ]
   },
   "createdbproxyendpoint": {
@@ -739,7 +740,9 @@
         "name": "proxy",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": []
+        "dependentActions": [
+          "rds:AddTagsToResource"
+        ]
       },
       {
         "name": "proxy-endpoint",
@@ -965,7 +968,8 @@
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
-      "rds:TenantDatabaseName"
+      "rds:TenantDatabaseName",
+      "rds:ManageMasterUserPassword"
     ],
     "dependentActions": []
   },
@@ -2695,7 +2699,8 @@
       }
     ],
     "conditionKeys": [
-      "rds:TenantDatabaseName"
+      "rds:TenantDatabaseName",
+      "rds:ManageMasterUserPassword"
     ],
     "dependentActions": []
   },
@@ -2738,7 +2743,9 @@
         "name": "ri",
         "required": true,
         "conditionKeys": [],
-        "dependentActions": []
+        "dependentActions": [
+          "rds:AddTagsToResource"
+        ]
       }
     ],
     "conditionKeys": [
@@ -3254,7 +3261,8 @@
       "rds:BackupTarget",
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
-      "rds:req-tag/${TagKey}"
+      "rds:req-tag/${TagKey}",
+      "rds:ManageMasterUserPassword"
     ],
     "dependentActions": []
   },
@@ -3355,7 +3363,8 @@
       "rds:BackupTarget",
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
-      "rds:req-tag/${TagKey}"
+      "rds:req-tag/${TagKey}",
+      "rds:ManageMasterUserPassword"
     ],
     "dependentActions": []
   },

package/data/actions/uxc.json

@@ -0,0 +1,26 @@
+{
+  "deleteaccountcolor": {
+    "name": "DeleteAccountColor",
+    "description": "Grants permission to delete account color setting",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "getaccountcolor": {
+    "name": "GetAccountColor",
+    "description": "Grants permission to retrieve account color setting",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "putaccountcolor": {
+    "name": "PutAccountColor",
+    "description": "Grants permission to set account color",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  }
+}

package/data/conditionKeys/connect.json

@@ -49,6 +49,16 @@
     "description": "Filters access by restricting federation into specified Amazon Connect instances",
     "type": "String"
   },
+  "connect:listrealtimecontactanalysissegmentsbyoutputtype": {
+    "key": "connect:ListRealtimeContactAnalysisSegmentsByOutputType",
+    "description": "Filters access by restricting the listed segments using the output type of the Amazon Connect Contact Lens real-time segment",
+    "type": "String"
+  },
+  "connect:listrealtimecontactanalysissegmentsbysegmenttype": {
+    "key": "connect:ListRealtimeContactAnalysisSegmentsBySegmentType",
+    "description": "Filters access by restricting the listed segments using the segment types of the Amazon Connect Contact Lens real-time segment",
+    "type": "ArrayOfString"
+  },
   "connect:monitorcapabilities": {
     "key": "connect:MonitorCapabilities",
     "description": "Filters access by restricting the monitor capabilities of the user in the request",

package/data/conditionKeys/route53.json

@@ -17,6 +17,6 @@
   "route53:vpcs": {
     "key": "route53:VPCs",
     "description": "Filters access by VPCs in request",
-    "type": "ArrayOfString"
+    "type": "String"
   }
 }

package/data/conditionKeys/uxc.json

@@ -0,0 +1 @@
+{}

package/data/resourceTypes/bedrock.json

@@ -154,15 +154,24 @@
   },
   "data-automation-project": {
     "key": "data-automation-project",
-    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-project/${ProjectId}"
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-project/${ProjectId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "blueprint": {
     "key": "blueprint",
-    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:blueprint/${BlueprintId}"
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:blueprint/${BlueprintId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "data-automation-invocation-job": {
     "key": "data-automation-invocation-job",
-    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-invocation/${JobId}"
+    "arn": "arn:${Partition}:bedrock:${Region}:${Account}:data-automation-invocation/${JobId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "data-automation-profile": {
     "key": "data-automation-profile",

package/data/resourceTypes/eks.json

@@ -63,5 +63,12 @@
   "access-policy": {
     "key": "access-policy",
     "arn": "arn:${Partition}:eks::aws:cluster-access-policy/${AccessPolicyName}"
+  },
+  "dashboard": {
+    "key": "dashboard",
+    "arn": "arn:${Partition}:eks:${Region}:${Account}:dashboard/${DashboardName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

package/data/resourceTypes/uxc.json

@@ -0,0 +1 @@
+{}

package/data/serviceNames.json

@@ -370,7 +370,7 @@
   "ssm-sap": "AWS Systems Manager for SAP",
   "ssmmessages": "Amazon Message Gateway Service",
   "sso": "AWS IAM Identity Center",
-  "sso-directory": "AWS IAM Identity Center (successor to AWS Single Sign-On) directory",
+  "sso-directory": "AWS IAM Identity Center directory",
   "sso-oauth": "AWS IAM Identity Center OIDC service",
   "states": "AWS Step Functions",
   "storagegateway": "AWS Storage Gateway",
@@ -397,6 +397,7 @@
   "trustedadvisor": "AWS Trusted Advisor",
   "ts": "AWS Diagnostic tools",
   "user-subscriptions": "AWS User Subscriptions",
+  "uxc": "AWS Service for managing account level display settings",
   "vendor-insights": "AWS Marketplace Vendor Insights",
   "verified-access": "AWS Verified Access",
   "verifiedpermissions": "Amazon Verified Permissions",

package/data/services.json

@@ -397,6 +397,7 @@
   "trustedadvisor",
   "ts",
   "user-subscriptions",
+  "uxc",
   "vendor-insights",
   "verified-access",
   "verifiedpermissions",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@cloud-copilot/iam-data",
-  "version": "0.9.202505201",
+  "version": "0.9.202505231",
   "description": "AWS IAM Data",
   "repository": "github:cloud-copilot/iam-data",
-  "updatedAt": "2025-05-20T04:48:41.277Z",
+  "updatedAt": "2025-05-23T04:48:05.290Z",
   "exports": {
     ".": {
       "import": "./dist/esm/index.js",