aws-iam-language-server 0.0.7 → 0.0.9

package/src/data/servicereference/services/xray.json

@@ -1 +1 @@
-{"name":"xray","actions":{"BatchGetTraceSummaryById":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve metadata for a list of traces specified by ID","accessLevel":"Read","resourceTypes":[],"permissionOnly":true},"BatchGetTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs","accessLevel":"List","resourceTypes":[]},"CancelTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response","accessLevel":"Read","resourceTypes":[]},"CreateGroup":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"}],"description":"Grants permission to create a group resource with a name and a filter expression","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"CreateSamplingRule":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to create a rule to control sampling behavior for instrumented applications","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"DeleteGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to delete a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"DeleteResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to delete resource policies","accessLevel":"Write","resourceTypes":[]},"DeleteSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to delete a sampling rule","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"GetDistinctTraceGraphs":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve distinct service graphs for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"permissionOnly":true},"GetEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current encryption configuration for X-Ray data","accessLevel":"Read","resourceTypes":[]},"GetGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to retrieve group resource details","accessLevel":"Read","resourceTypes":[{"name":"group","required":true}]},"GetGroups":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all active group details","accessLevel":"Read","resourceTypes":[]},"GetIndexingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray","accessLevel":"Read","resourceTypes":[]},"GetInsight":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the details of a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightEvents":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the events of a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightImpactGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the part of the service graph which is impacted for a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the summary of all insights for a group and time range with optional filters","accessLevel":"Read","resourceTypes":[]},"GetRetrievedTracesGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[]},"GetSamplingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all sampling rules","accessLevel":"Read","resourceTypes":[]},"GetSamplingStatisticSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve information about recent sampling results for all sampling rules","accessLevel":"Read","resourceTypes":[]},"GetSamplingTargets":{"conditionKeys":[],"resources":[],"description":"Grants permission to request a sampling quota for rules that the service is using to sample requests","accessLevel":"Read","resourceTypes":[]},"GetServiceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result","accessLevel":"Read","resourceTypes":[]},"GetTimeSeriesServiceStatistics":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals","accessLevel":"Read","resourceTypes":[]},"GetTraceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[]},"GetTraceSegmentDestination":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Read","resourceTypes":[]},"GetTraceSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces","accessLevel":"Read","resourceTypes":[]},"Link":{"conditionKeys":[],"resources":[],"description":"Grants permission to share X-Ray resources with a monitoring account","accessLevel":"Write","resourceTypes":[],"permissionOnly":true},"ListResourcePolicies":{"conditionKeys":[],"resources":[],"description":"Grants permission to list resource policies","accessLevel":"List","resourceTypes":[]},"ListRetrievedTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"List","resourceTypes":[]},"ListTagsForResource":{"conditionKeys":[],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to list tags for an X-Ray resource","accessLevel":"List","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"PutEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to update the encryption configuration for X-Ray data","accessLevel":"Permissions management","resourceTypes":[]},"PutResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to create or update resource policies","accessLevel":"Write","resourceTypes":[]},"PutSpans":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload OpenTelemetry spans to AWS X-Ray","accessLevel":"Write","resourceTypes":[]},"PutSpansForIndexing":{"conditionKeys":[],"resources":[],"description":"Grants permission to upload spans to AWS X-Ray to be indexed","accessLevel":"Write","resourceTypes":[],"permissionOnly":true},"PutTelemetryRecords":{"conditionKeys":[],"resources":[],"description":"Grants permission to send AWS X-Ray daemon telemetry to the service","accessLevel":"Write","resourceTypes":[]},"PutTraceSegments":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches","accessLevel":"Write","resourceTypes":[]},"StartTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to initiate a trace retrieval process using the specified time range and for the given trace IDs on the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[]},"TagResource":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to add tags to an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"UntagResource":{"conditionKeys":["aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to remove tags from an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"UpdateGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to update a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"UpdateIndexingRule":{"conditionKeys":[],"resources":[],"description":"Grants permission to modify an indexing rule's configuration","accessLevel":"Write","resourceTypes":[]},"UpdateSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to modify a sampling rule's configuration","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"UpdateTraceSegmentDestination":{"conditionKeys":["xray:TraceSegmentDestination"],"resources":[],"description":"Grants permission to modify the destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Write","resourceTypes":[]}},"resources":[{"name":"group","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]},{"name":"sampling-rule","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]}],"conditionKeys":{"aws:RequestTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags that are passed in the request"},"aws:ResourceTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags associated with the resource"},"aws:TagKeys":{"types":["ArrayOfString"],"description":"Filters access by the tag keys that are passed in the request"},"logs:LogGeneratingResourceArns":{"types":["ArrayOfARN"],"description":"Filters access by LogGeneratingResourceArn in the request"},"xray:ResourcePolicyName":{"types":["String"],"description":"Filters access by PolicyName in the request"},"xray:TraceSegmentDestination":{"types":["String"],"description":"Filters access by TraceSegmentDestination type in the request"}}}
+{"name":"xray","actions":{"BatchGetTraceSummaryById":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve metadata for a list of traces specified by ID","accessLevel":"Read","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-BatchGetTraceSummaryById"},"BatchGetTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs","accessLevel":"List","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_BatchGetTraces.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-BatchGetTraces"},"CancelTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_CancelTraceRetrieval.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CancelTraceRetrieval"},"CreateGroup":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"}],"description":"Grants permission to create a group resource with a name and a filter expression","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_CreateGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CreateGroup"},"CreateSamplingRule":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to create a rule to control sampling behavior for instrumented applications","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_CreateSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CreateSamplingRule"},"DeleteGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to delete a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteGroup"},"DeleteResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to delete resource policies","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteResourcePolicy.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteResourcePolicy"},"DeleteSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to delete a sampling rule","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteSamplingRule"},"GetDistinctTraceGraphs":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve distinct service graphs for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetDistinctTraceGraphs"},"GetEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current encryption configuration for X-Ray data","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetEncryptionConfig.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetEncryptionConfig"},"GetGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to retrieve group resource details","accessLevel":"Read","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetGroup"},"GetGroups":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all active group details","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetGroups.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetGroups"},"GetIndexingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetIndexingRules.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetIndexingRules"},"GetInsight":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the details of a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsight.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsight"},"GetInsightEvents":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the events of a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightEvents.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightEvents"},"GetInsightImpactGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the part of the service graph which is impacted for a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightImpactGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightImpactGraph"},"GetInsightSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the summary of all insights for a group and time range with optional filters","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightSummaries"},"GetRetrievedTracesGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_GetRetrievedTracesGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetRetrievedTracesGraph"},"GetSamplingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all sampling rules","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingRules.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingRules"},"GetSamplingStatisticSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve information about recent sampling results for all sampling rules","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingStatisticSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingStatisticSummaries"},"GetSamplingTargets":{"conditionKeys":[],"resources":[],"description":"Grants permission to request a sampling quota for rules that the service is using to sample requests","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingTargets.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingTargets"},"GetServiceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetServiceGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetServiceGraph"},"GetTimeSeriesServiceStatistics":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTimeSeriesServiceStatistics.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTimeSeriesServiceStatistics"},"GetTraceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceGraph"},"GetTraceSegmentDestination":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSegmentDestination.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceSegmentDestination"},"GetTraceSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceSummaries"},"Link":{"conditionKeys":[],"resources":[],"description":"Grants permission to share X-Ray resources with a monitoring account","accessLevel":"Write","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#CloudWatch-Unified-Cross-Account-Setup-permissions","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-Link"},"ListResourcePolicies":{"conditionKeys":[],"resources":[],"description":"Grants permission to list resource policies","accessLevel":"List","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_ListResourcePolicies.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListResourcePolicies"},"ListRetrievedTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"List","resourceTypes":[],"operationUrl":"API_ListRetrievedTraces.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListRetrievedTraces"},"ListTagsForResource":{"conditionKeys":[],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to list tags for an X-Ray resource","accessLevel":"List","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_ListTagsForResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListTagsForResource"},"PutEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to update the encryption configuration for X-Ray data","accessLevel":"Permissions management","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutEncryptionConfig.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutEncryptionConfig"},"PutResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to create or update resource policies","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutResourcePolicy.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutResourcePolicy"},"PutSpans":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload OpenTelemetry spans to AWS X-Ray","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutSpans"},"PutSpansForIndexing":{"conditionKeys":[],"resources":[],"description":"Grants permission to upload spans to AWS X-Ray to be indexed","accessLevel":"Write","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutSpansForIndexing"},"PutTelemetryRecords":{"conditionKeys":[],"resources":[],"description":"Grants permission to send AWS X-Ray daemon telemetry to the service","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutTelemetryRecords.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutTelemetryRecords"},"PutTraceSegments":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutTraceSegments.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutTraceSegments"},"StartTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to initiate a trace retrieval process using the specified time range and for the given trace IDs on the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_StartTraceRetrieval","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-StartTraceRetrieval"},"TagResource":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to add tags to an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_TagResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-TagResource"},"UntagResource":{"conditionKeys":["aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to remove tags from an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UntagResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UntagResource"},"UpdateGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to update a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateGroup"},"UpdateIndexingRule":{"conditionKeys":[],"resources":[],"description":"Grants permission to modify an indexing rule's configuration","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateIndexingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateIndexingRule"},"UpdateSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to modify a sampling rule's configuration","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateSamplingRule"},"UpdateTraceSegmentDestination":{"conditionKeys":["xray:TraceSegmentDestination"],"resources":[],"description":"Grants permission to modify the destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateTraceSegmentDestination.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateTraceSegmentDestination"}},"resources":[{"name":"group","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]},{"name":"sampling-rule","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]}],"conditionKeys":{"aws:RequestTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags that are passed in the request"},"aws:ResourceTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags associated with the resource"},"aws:TagKeys":{"types":["ArrayOfString"],"description":"Filters access by the tag keys that are passed in the request"},"logs:LogGeneratingResourceArns":{"types":["ArrayOfARN"],"description":"Filters access by LogGeneratingResourceArn in the request"},"xray:ResourcePolicyName":{"types":["String"],"description":"Filters access by PolicyName in the request"},"xray:TraceSegmentDestination":{"types":["String"],"description":"Filters access by TraceSegmentDestination type in the request"}},"url":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html"}

package/src/handlers/document-link/document-link.d.ts

@@ -0,0 +1,4 @@
+import type { DocumentLink, DocumentLinkParams, TextDocuments } from 'vscode-languageserver';
+import type { TextDocument } from 'vscode-languageserver-textdocument';
+import type { TreeManager } from '../../lib/treesitter/manager.ts';
+export declare function documentLinkHandler(params: DocumentLinkParams, documents: TextDocuments<TextDocument>, _treeManager: TreeManager): DocumentLink[];

package/src/handlers/document-link/document-link.js

@@ -0,0 +1,36 @@
+import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
+export function documentLinkHandler(params, documents, _treeManager) {
+    const document = documents.get(params.textDocument.uri);
+    if (!document)
+        return [];
+    const text = document.getText();
+    const links = [];
+    const actionSet = new Set(ServiceReference.getAllActions().map((a) => a.toLowerCase()));
+    const pattern = /[a-z0-9-]+:[A-Za-z0-9*?]+/g;
+    for (const match of text.matchAll(pattern)) {
+        if (!actionSet.has(match[0].toLowerCase()))
+            continue;
+        const [serviceName, actionName] = match[0].split(':');
+        const action = ServiceReference.getAction(serviceName, actionName);
+        if (!action)
+            continue;
+        const index = match.index ?? 0;
+        const start = document.positionAt(index);
+        const end = document.positionAt(index + match[0].length);
+        if (action.iamUrl) {
+            links.push({
+                range: { start, end },
+                target: action.iamUrl,
+                tooltip: 'IAM Actions, Conditions, and Context Keys',
+            });
+        }
+        if (action.operationUrl) {
+            links.push({
+                range: { start, end },
+                target: action.operationUrl,
+                tooltip: 'API Operation Documentation',
+            });
+        }
+    }
+    return links;
+}

package/src/lib/iam-policy/reference/types.d.ts

@@ -43,6 +43,7 @@ export type RawReference = {
 };
 export type ServiceData = {
     name: string;
+    url?: string;
     actions: Record<string, Action>;
     resources: Array<{
         name: string;
@@ -64,6 +65,8 @@ export type Action = {
     }>;
     dependentActions?: Array<string>;
     permissionOnly?: boolean;
+    operationUrl?: string;
+    iamUrl?: string;
 };
 export type ConditionKey = {
     types: Array<string>;

package/src/lib/treesitter/base.d.ts

@@ -8,6 +8,7 @@ export type CursorContext = {
     keys: string[];
     role: 'key' | 'value';
     partial: string;
+    value: string;
     policyFormat: PolicyFormat;
 };
 export type StatementContext = {

package/src/lib/treesitter/hcl.js

@@ -163,8 +163,8 @@ export class TreeHcl extends TreeBase {
         }
         if (role === null)
             role = 'key';
-        const partial = this.#extractJsonencodePartial(cursorNode, position);
-        return { keys, role, partial };
+        const { partial, value } = this.#extractJsonencodePartialAndValue(cursorNode, position);
+        return { keys, role, partial, value };
     }
     #getObjectElemKey(element) {
         const keyExpression = element.namedChildren.find((child) => child.type === 'expression');
@@ -191,20 +191,21 @@ export class TreeHcl extends TreeBase {
             .map((element) => this.#getObjectElemKey(element))
             .filter((key) => key !== null);
     }
-    #extractJsonencodePartial(node, position) {
+    #extractJsonencodePartialAndValue(node, position) {
         let current = node;
         while (current) {
             if (current.type === 'identifier' || current.type === 'template_literal') {
+                const value = current.text;
                 if (position.line === current.startPosition.row) {
-                    return current.text.slice(0, position.column - current.startPosition.column);
+                    return { partial: value.slice(0, position.column - current.startPosition.column), value };
                 }
-                return current.text;
+                return { partial: value, value };
             }
             if (current.type === 'object' || current.type === 'object_elem')
                 break;
             current = current.parent;
         }
-        return '';
+        return { partial: '', value: '' };
     }
     // ---------------------------------------------------------------------------
     // Block mode — block/body/attribute, snake_case keys
@@ -226,7 +227,7 @@ export class TreeHcl extends TreeBase {
             return this.#pickBestCursorContext(context1, context2);
         }
         // Cursor is on the block itself (outside body span) — statement-key level
-        const partial = this.#extractBlockPartial(node, position);
+        const { partial, value } = this.#extractBlockPartialAndValue(node, position);
         // Check for incomplete attributes on the same line (may be in ERROR nodes
         // when tree-sitter can't parse the body due to a missing value)
         const searchParent = statementBody ?? statementBlock;
@@ -242,6 +243,7 @@ export class TreeHcl extends TreeBase {
                         keys: [id.text],
                         role: 'value',
                         partial: '',
+                        value: '',
                         policyFormat: 'hcl-block',
                     };
                 }
@@ -251,6 +253,7 @@ export class TreeHcl extends TreeBase {
             keys: [],
             role: 'key',
             partial,
+            value,
             policyFormat: 'hcl-block',
         };
     }
@@ -339,8 +342,8 @@ export class TreeHcl extends TreeBase {
         }
         if (role === null)
             role = 'key';
-        const partial = this.#extractBlockPartial(cursorNode, position);
-        return { keys, role, partial };
+        const { partial, value } = this.#extractBlockPartialAndValue(cursorNode, position);
+        return { keys, role, partial, value };
     }
     #findEnclosingBlock(node, blockName, statementBody) {
         let current = node;
@@ -390,20 +393,21 @@ export class TreeHcl extends TreeBase {
     #hasBodyAttribute(body, name) {
         return body.namedChildren.some((child) => child.type === 'attribute' && child.namedChildren.some((id) => id.type === 'identifier' && id.text === name));
     }
-    #extractBlockPartial(node, position) {
+    #extractBlockPartialAndValue(node, position) {
         let current = node;
         while (current) {
             if (current.type === 'identifier' || current.type === 'template_literal') {
+                const value = current.text;
                 if (position.line === current.startPosition.row) {
-                    return current.text.slice(0, position.column - current.startPosition.column);
+                    return { partial: value.slice(0, position.column - current.startPosition.column), value };
                 }
-                return current.text;
+                return { partial: value, value };
             }
             if (current.type === 'body' || current.type === 'attribute' || current.type === 'block')
                 break;
             current = current.parent;
         }
-        return '';
+        return { partial: '', value: '' };
     }
     // ---------------------------------------------------------------------------
     // Shared
@@ -533,20 +537,21 @@ export class TreeHcl extends TreeBase {
         }
         if (!foundStatement || !lastKey || !policyFormat)
             return null;
-        // Extract partial: when the key came from an attribute/object_elem that
-        // contains the quote (e.g., `effect = "`), it's empty. When the cursor node
-        // is inside a string (open quote slurped subsequent lines), extract from the
-        // template_literal. Otherwise extract from ERROR node text.
+        // Extract partial and value: when the key came from an attribute/object_elem
+        // that contains the quote (e.g., `effect = "`), they're empty. When the
+        // cursor node is inside a string (open quote slurped subsequent lines),
+        // extract from the template_literal. Otherwise extract from ERROR node text.
         let partial = '';
+        let value = '';
         if (!lastKeyFromAttribute) {
             if (this.#isInsideQuote(node)) {
-                partial = this.#extractQuotedPartial(node, position);
+                ({ partial, value } = this.#extractQuotedPartialAndValue(node, position));
             }
             else if (nodeBefore && this.#isInsideQuote(nodeBefore)) {
-                partial = this.#extractQuotedPartial(nodeBefore, position);
+                ({ partial, value } = this.#extractQuotedPartialAndValue(nodeBefore, position));
             }
             else {
-                partial = this.#extractPartialFromErrorNode(errorNode, position);
+                ({ partial, value } = this.#extractPartialAndValueFromErrorNode(errorNode, position));
             }
         }
         // Build keys with sub-block prefix when inside a sub-block
@@ -561,6 +566,7 @@ export class TreeHcl extends TreeBase {
             keys,
             role: 'value',
             partial,
+            value,
             policyFormat,
         };
     }
@@ -568,27 +574,29 @@ export class TreeHcl extends TreeBase {
      * Extract partial from inside a quoted string (when the open quote caused
      * tree-sitter to slurp subsequent lines into a string_lit).
      */
-    #extractQuotedPartial(node, position) {
+    #extractQuotedPartialAndValue(node, position) {
         let current = node;
         while (current) {
             if (current.type === 'template_literal') {
+                const value = current.text;
                 if (position.line === current.startPosition.row) {
-                    return current.text.slice(0, position.column - current.startPosition.column);
+                    return { partial: value.slice(0, position.column - current.startPosition.column), value };
                 }
-                return '';
+                return { partial: '', value };
             }
             if (current.type === 'quoted_template_start')
-                return '';
+                return { partial: '', value: '' };
             if (current.type === 'string_lit') {
                 // Cursor is right after the opening quote, no template_literal yet
-                return '';
+                return { partial: '', value: '' };
             }
             current = current.parent;
         }
-        return '';
+        return { partial: '', value: '' };
     }
-    #extractPartialFromErrorNode(errorNode, position) {
+    #extractPartialAndValueFromErrorNode(errorNode, position) {
         let afterColumn = 0;
+        let nextChildColumn = null;
         for (const child of errorNode.children) {
             if (child.startPosition.row !== position.line)
                 continue;
@@ -599,14 +607,20 @@ export class TreeHcl extends TreeBase {
             if (child.endPosition.column <= position.column) {
                 afterColumn = child.endPosition.column;
             }
+            else if (nextChildColumn === null && child.startPosition.column > position.column) {
+                nextChildColumn = child.startPosition.column;
+            }
         }
         const lines = errorNode.text.split('\n');
         const lineIndex = position.line - errorNode.startPosition.row;
         if (lineIndex < 0 || lineIndex >= lines.length)
-            return '';
+            return { partial: '', value: '' };
         const line = lines[lineIndex];
         const startColumn = lineIndex === 0 ? errorNode.startPosition.column : 0;
-        return line.slice(afterColumn - startColumn, position.column - startColumn);
+        const partial = line.slice(afterColumn - startColumn, position.column - startColumn);
+        const valueEnd = nextChildColumn !== null ? nextChildColumn - startColumn : line.length;
+        const value = line.slice(afterColumn - startColumn, valueEnd);
+        return { partial, value };
     }
     #getExpressionIdentifier(expression) {
         const variableExpression = expression.namedChildren.find((child) => child.type === 'variable_expr');

package/src/lib/treesitter/json.js

@@ -122,8 +122,8 @@ export class TreeJson extends TreeBase {
         }
         if (role === null)
             role = 'key';
-        const partial = this.#extractPartial(cursorNode, position);
-        return { keys, role, partial };
+        const { partial, value } = this.#extractPartialAndValue(cursorNode, position);
+        return { keys, role, partial, value };
     }
     /**
      * Walk up from a node to find an object that sits inside a Statement array.
@@ -234,23 +234,24 @@ export class TreeJson extends TreeBase {
         return false;
     }
     /**
-     * Extract the partial text the user has typed, from the nearest string_content
-     * node up to the cursor position.
+     * Extract the partial text (up to cursor) and full value from the nearest
+     * string_content node.
      */
-    #extractPartial(node, position) {
+    #extractPartialAndValue(node, position) {
         let current = node;
         while (current) {
             if (current.type === 'string_content') {
+                const value = current.text;
                 if (position.line === current.startPosition.row) {
-                    return current.text.slice(0, position.column - current.startPosition.column);
+                    return { partial: value.slice(0, position.column - current.startPosition.column), value };
                 }
-                return current.text;
+                return { partial: value, value };
             }
             if (current.type === 'object' || current.type === 'pair')
                 break;
             current = current.parent;
         }
-        return '';
+        return { partial: '', value: '' };
     }
     /**
      * Read string values from a JSON pair's value (string or array of strings).

package/src/lib/treesitter/yaml.js

@@ -150,11 +150,12 @@ export class TreeYaml extends TreeBase {
         const resolved = this.#resolveWithinMapping(statementMapping, position);
         if (!resolved)
             return null;
-        const partial = this.#extractPartial(cursorNode, position);
+        const { partial, value } = this.#extractPartialAndValue(cursorNode, position);
         return {
             keys: resolved.keys,
             role: resolved.role,
             partial,
+            value,
             policyFormat: 'standard',
         };
     }
@@ -194,7 +195,7 @@ export class TreeYaml extends TreeBase {
                     return {
                         keys: [],
                         role: 'key',
-                        partial: this.#extractPartial(node, position),
+                        ...this.#extractPartialAndValue(node, position),
                         policyFormat: 'standard',
                     };
                 }
@@ -203,7 +204,7 @@ export class TreeYaml extends TreeBase {
                 return {
                     keys: [],
                     role: 'key',
-                    partial: this.#extractPartial(node, position),
+                    ...this.#extractPartialAndValue(node, position),
                     policyFormat: 'standard',
                 };
             }
@@ -229,7 +230,7 @@ export class TreeYaml extends TreeBase {
                     return {
                         keys: [],
                         role: 'key',
-                        partial: this.#extractPartial(node, position),
+                        ...this.#extractPartialAndValue(node, position),
                         policyFormat: 'standard',
                     };
                 }
@@ -397,8 +398,10 @@ export class TreeYaml extends TreeBase {
         }
         if (role === null)
             role = 'key';
-        const partial = colonPartial || this.#extractPartial(cursorNode, position);
-        return { keys, role, partial };
+        const { partial: extractedPartial, value: extractedValue } = this.#extractPartialAndValue(cursorNode, position);
+        const partial = colonPartial || extractedPartial;
+        const value = colonPartial ? colonPartial : extractedValue;
+        return { keys, role, partial, value };
     }
     /**
      * Resolve the cursor's position within a block_mapping by finding the pair covering
@@ -593,29 +596,29 @@ export class TreeYaml extends TreeBase {
             .filter((key) => key !== null);
     }
     /**
-     * Extract the partial text the user has typed, from the nearest scalar node
-     * up to the cursor position.
+     * Extract the partial text (up to cursor) and full value from the nearest
+     * scalar node.
      */
-    #extractPartial(node, position) {
+    #extractPartialAndValue(node, position) {
         let current = node;
         while (current) {
             if (current.type === 'string_scalar') {
-                return this.#sliceToPosition(current.text, current.startPosition.column, position, node);
+                return this.#sliceToPositionAndValue(current.text, current.startPosition.column, position, node);
             }
             if (current.type === 'double_quote_scalar' || current.type === 'single_quote_scalar') {
-                return this.#sliceToPosition(current.text.slice(1, -1), current.startPosition.column + 1, position, node);
+                return this.#sliceToPositionAndValue(current.text.slice(1, -1), current.startPosition.column + 1, position, node);
             }
             if (current.type === 'block_mapping' || current.type === 'block_mapping_pair')
                 break;
             current = current.parent;
         }
-        return '';
+        return { partial: '', value: '' };
     }
-    #sliceToPosition(text, startColumn, position, node) {
+    #sliceToPositionAndValue(text, startColumn, position, node) {
         if (position.line === node.startPosition.row) {
-            return text.slice(0, position.column - startColumn);
+            return { partial: text.slice(0, position.column - startColumn), value: text };
         }
-        return text;
+        return { partial: text, value: text };
     }
     /**
      * When tree-sitter produces a root-level ERROR (e.g., unterminated quote in
@@ -662,6 +665,7 @@ export class TreeYaml extends TreeBase {
                     keys: [keyText],
                     role: 'value',
                     partial: '',
+                    value: '',
                     policyFormat: 'standard',
                 };
             }
@@ -674,10 +678,12 @@ export class TreeYaml extends TreeBase {
                 const valueText = this.#getPairValueText(child) ?? '';
                 // If cursor is past the ERROR end (colon continuation), append ":"
                 const colonSuffix = errorNode.endPosition.row === position.line && position.column > errorNode.endPosition.column ? ':' : '';
+                const fullValue = valueText + colonSuffix;
                 return {
                     keys: [pairKey],
                     role: 'value',
-                    partial: valueText + colonSuffix,
+                    partial: fullValue,
+                    value: fullValue,
                     policyFormat: 'standard',
                 };
             }
@@ -693,39 +699,49 @@ export class TreeYaml extends TreeBase {
         // If we found a key before cursor line and the cursor is in its value area
         // (e.g., `Resource:\n  - !Sub "arn:` where the open quote breaks the parse)
         if (lastKey) {
-            const partial = this.#extractPartialFromErrorNode(errorNode, position);
+            const { partial, value } = this.#extractPartialAndValueFromErrorNode(errorNode, position);
             return {
                 keys: [lastKey],
                 role: 'value',
                 partial,
+                value,
                 policyFormat: 'standard',
             };
         }
         return null;
     }
     /**
-     * Extract the partial text from an ERROR node for the cursor line.
+     * Extract the partial text and full value from an ERROR node for the cursor line.
      * Scans ERROR children on the cursor line to find the last child before/at the
-     * cursor, then takes the substring from its end to the cursor column.
+     * cursor, then takes the substring from its end to the cursor column (partial)
+     * and to the next child or end of content (value).
      */
-    #extractPartialFromErrorNode(errorNode, position) {
-        // Find the rightmost child on the cursor line that ends at or before the cursor
+    #extractPartialAndValueFromErrorNode(errorNode, position) {
+        // Find the rightmost child on the cursor line that ends at or before the cursor,
+        // and the leftmost child that starts after the cursor
         let afterColumn = 0;
+        let nextChildColumn = null;
         for (const child of errorNode.children) {
             if (child.startPosition.row !== position.line)
                 continue;
             if (child.endPosition.column <= position.column) {
                 afterColumn = child.endPosition.column;
             }
+            else if (nextChildColumn === null && child.startPosition.column > position.column) {
+                nextChildColumn = child.startPosition.column;
+            }
         }
         // Extract from the ERROR node's text: find the cursor line and slice
         const lines = errorNode.text.split('\n');
         const lineIndex = position.line - errorNode.startPosition.row;
         if (lineIndex < 0 || lineIndex >= lines.length)
-            return '';
+            return { partial: '', value: '' };
         const line = lines[lineIndex];
         const startColumn = lineIndex === 0 ? errorNode.startPosition.column : 0;
-        return line.slice(afterColumn - startColumn, position.column - startColumn);
+        const partial = line.slice(afterColumn - startColumn, position.column - startColumn);
+        const valueEnd = nextChildColumn !== null ? nextChildColumn - startColumn : line.length;
+        const value = line.slice(afterColumn - startColumn, valueEnd);
+        return { partial, value };
     }
     #getPairValueText(pair) {
         const flowNodes = pair.namedChildren.filter((child) => child.type === 'flow_node');

package/src/server.js

@@ -2,6 +2,7 @@
 import { createConnection, ProposedFeatures, TextDocumentSyncKind, TextDocuments } from 'vscode-languageserver/node.js';
 import { TextDocument } from 'vscode-languageserver-textdocument';
 import { handleCompletionRequest } from "./handlers/completion/index.js";
+import { documentLinkHandler } from "./handlers/document-link/document-link.js";
 import { TreeManager } from "./lib/treesitter/manager.js";
 const connection = createConnection(ProposedFeatures.all);
 const documents = new TextDocuments(TextDocument);
@@ -15,6 +16,7 @@ connection.onInitialize(async () => {
                 triggerCharacters: ['"', ':', '*'],
             },
             hoverProvider: false,
+            documentLinkProvider: {},
         },
     };
 });
@@ -22,5 +24,6 @@ documents.onDidOpen(({ document }) => treeManager.openDocument(document.uri, doc
 documents.onDidChangeContent(({ document }) => treeManager.updateDocument(document.uri, document.getText()));
 documents.onDidClose(({ document }) => treeManager.closeDocument(document.uri));
 connection.onCompletion((params) => handleCompletionRequest(params, documents, treeManager));
+connection.onDocumentLinks((params) => documentLinkHandler(params, documents, treeManager));
 documents.listen(connection);
 connection.listen();

package/.direnv/bin/nix-direnv-reload

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -e
-if [[ ! -d "/Users/mbarney/dev/personal/aws-iam-ls" ]]; then
-  echo "Cannot find source directory; Did you move it?"
-  echo "(Looking for "/Users/mbarney/dev/personal/aws-iam-ls")"
-  echo 'Cannot force reload with this script - use "direnv reload" manually and then try again'
-  exit 1
-fi
-
-# rebuild the cache forcefully
-_nix_direnv_force_reload=1 direnv exec "/Users/mbarney/dev/personal/aws-iam-ls" true
-
-# Update the mtime for .envrc.
-# This will cause direnv to reload again - but without re-building.
-touch "/Users/mbarney/dev/personal/aws-iam-ls/.envrc"
-
-# Also update the timestamp of whatever profile_rc we have.
-# This makes sure that we know we are up to date.
-touch -r "/Users/mbarney/dev/personal/aws-iam-ls/.envrc" "/Users/mbarney/dev/personal/aws-iam-ls/.direnv"/*.rc