aws-iam-language-server 0.0.8 → 0.0.10

package/src/data/servicereference/services/xray.json

@@ -1 +1 @@
-{"name":"xray","actions":{"BatchGetTraceSummaryById":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve metadata for a list of traces specified by ID","accessLevel":"Read","resourceTypes":[],"permissionOnly":true},"BatchGetTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs","accessLevel":"List","resourceTypes":[]},"CancelTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response","accessLevel":"Read","resourceTypes":[]},"CreateGroup":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"}],"description":"Grants permission to create a group resource with a name and a filter expression","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"CreateSamplingRule":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to create a rule to control sampling behavior for instrumented applications","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"DeleteGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to delete a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"DeleteResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to delete resource policies","accessLevel":"Write","resourceTypes":[]},"DeleteSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to delete a sampling rule","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"GetDistinctTraceGraphs":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve distinct service graphs for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"permissionOnly":true},"GetEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current encryption configuration for X-Ray data","accessLevel":"Read","resourceTypes":[]},"GetGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to retrieve group resource details","accessLevel":"Read","resourceTypes":[{"name":"group","required":true}]},"GetGroups":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all active group details","accessLevel":"Read","resourceTypes":[]},"GetIndexingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray","accessLevel":"Read","resourceTypes":[]},"GetInsight":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the details of a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightEvents":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the events of a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightImpactGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the part of the service graph which is impacted for a specific insight","accessLevel":"Read","resourceTypes":[]},"GetInsightSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the summary of all insights for a group and time range with optional filters","accessLevel":"Read","resourceTypes":[]},"GetRetrievedTracesGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[]},"GetSamplingRules":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all sampling rules","accessLevel":"Read","resourceTypes":[]},"GetSamplingStatisticSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve information about recent sampling results for all sampling rules","accessLevel":"Read","resourceTypes":[]},"GetSamplingTargets":{"conditionKeys":[],"resources":[],"description":"Grants permission to request a sampling quota for rules that the service is using to sample requests","accessLevel":"Read","resourceTypes":[]},"GetServiceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result","accessLevel":"Read","resourceTypes":[]},"GetTimeSeriesServiceStatistics":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals","accessLevel":"Read","resourceTypes":[]},"GetTraceGraph":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[]},"GetTraceSegmentDestination":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Read","resourceTypes":[]},"GetTraceSummaries":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces","accessLevel":"Read","resourceTypes":[]},"Link":{"conditionKeys":[],"resources":[],"description":"Grants permission to share X-Ray resources with a monitoring account","accessLevel":"Write","resourceTypes":[],"permissionOnly":true},"ListResourcePolicies":{"conditionKeys":[],"resources":[],"description":"Grants permission to list resource policies","accessLevel":"List","resourceTypes":[]},"ListRetrievedTraces":{"conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"List","resourceTypes":[]},"ListTagsForResource":{"conditionKeys":[],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to list tags for an X-Ray resource","accessLevel":"List","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"PutEncryptionConfig":{"conditionKeys":[],"resources":[],"description":"Grants permission to update the encryption configuration for X-Ray data","accessLevel":"Permissions management","resourceTypes":[]},"PutResourcePolicy":{"conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to create or update resource policies","accessLevel":"Write","resourceTypes":[]},"PutSpans":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload OpenTelemetry spans to AWS X-Ray","accessLevel":"Write","resourceTypes":[]},"PutSpansForIndexing":{"conditionKeys":[],"resources":[],"description":"Grants permission to upload spans to AWS X-Ray to be indexed","accessLevel":"Write","resourceTypes":[],"permissionOnly":true},"PutTelemetryRecords":{"conditionKeys":[],"resources":[],"description":"Grants permission to send AWS X-Ray daemon telemetry to the service","accessLevel":"Write","resourceTypes":[]},"PutTraceSegments":{"conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches","accessLevel":"Write","resourceTypes":[]},"StartTraceRetrieval":{"conditionKeys":[],"resources":[],"description":"Grants permission to initiate a trace retrieval process using the specified time range and for the given trace IDs on the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[]},"TagResource":{"conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to add tags to an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"UntagResource":{"conditionKeys":["aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to remove tags from an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}]},"UpdateGroup":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to update a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}]},"UpdateIndexingRule":{"conditionKeys":[],"resources":[],"description":"Grants permission to modify an indexing rule's configuration","accessLevel":"Write","resourceTypes":[]},"UpdateSamplingRule":{"conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to modify a sampling rule's configuration","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}]},"UpdateTraceSegmentDestination":{"conditionKeys":["xray:TraceSegmentDestination"],"resources":[],"description":"Grants permission to modify the destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Write","resourceTypes":[]}},"resources":[{"name":"group","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]},{"name":"sampling-rule","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]}],"conditionKeys":{"aws:RequestTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags that are passed in the request"},"aws:ResourceTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags associated with the resource"},"aws:TagKeys":{"types":["ArrayOfString"],"description":"Filters access by the tag keys that are passed in the request"},"logs:LogGeneratingResourceArns":{"types":["ArrayOfARN"],"description":"Filters access by LogGeneratingResourceArn in the request"},"xray:ResourcePolicyName":{"types":["String"],"description":"Filters access by PolicyName in the request"},"xray:TraceSegmentDestination":{"types":["String"],"description":"Filters access by TraceSegmentDestination type in the request"}}}
+{"name":"xray","actions":{"BatchGetTraceSummaryById":{"name":"BatchGetTraceSummaryById","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve metadata for a list of traces specified by ID","accessLevel":"Read","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-BatchGetTraceSummaryById"},"BatchGetTraces":{"name":"BatchGetTraces","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs","accessLevel":"List","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_BatchGetTraces.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-BatchGetTraces"},"CancelTraceRetrieval":{"name":"CancelTraceRetrieval","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_CancelTraceRetrieval.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CancelTraceRetrieval"},"CreateGroup":{"name":"CreateGroup","service":"xray","conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"}],"description":"Grants permission to create a group resource with a name and a filter expression","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_CreateGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CreateGroup"},"CreateSamplingRule":{"name":"CreateSamplingRule","service":"xray","conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to create a rule to control sampling behavior for instrumented applications","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_CreateSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-CreateSamplingRule"},"DeleteGroup":{"name":"DeleteGroup","service":"xray","conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to delete a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteGroup"},"DeleteResourcePolicy":{"name":"DeleteResourcePolicy","service":"xray","conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to delete resource policies","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteResourcePolicy.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteResourcePolicy"},"DeleteSamplingRule":{"name":"DeleteSamplingRule","service":"xray","conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to delete a sampling rule","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_DeleteSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-DeleteSamplingRule"},"GetDistinctTraceGraphs":{"name":"GetDistinctTraceGraphs","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve distinct service graphs for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetDistinctTraceGraphs"},"GetEncryptionConfig":{"name":"GetEncryptionConfig","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current encryption configuration for X-Ray data","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetEncryptionConfig.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetEncryptionConfig"},"GetGroup":{"name":"GetGroup","service":"xray","conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to retrieve group resource details","accessLevel":"Read","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetGroup"},"GetGroups":{"name":"GetGroups","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all active group details","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetGroups.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetGroups"},"GetIndexingRules":{"name":"GetIndexingRules","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetIndexingRules.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetIndexingRules"},"GetInsight":{"name":"GetInsight","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the details of a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsight.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsight"},"GetInsightEvents":{"name":"GetInsightEvents","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the events of a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightEvents.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightEvents"},"GetInsightImpactGraph":{"name":"GetInsightImpactGraph","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the part of the service graph which is impacted for a specific insight","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightImpactGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightImpactGraph"},"GetInsightSummaries":{"name":"GetInsightSummaries","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the summary of all insights for a group and time range with optional filters","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetInsightSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetInsightSummaries"},"GetRetrievedTracesGraph":{"name":"GetRetrievedTracesGraph","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_GetRetrievedTracesGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetRetrievedTracesGraph"},"GetSamplingRules":{"name":"GetSamplingRules","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve all sampling rules","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingRules.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingRules"},"GetSamplingStatisticSummaries":{"name":"GetSamplingStatisticSummaries","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve information about recent sampling results for all sampling rules","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingStatisticSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingStatisticSummaries"},"GetSamplingTargets":{"name":"GetSamplingTargets","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to request a sampling quota for rules that the service is using to sample requests","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingTargets.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetSamplingTargets"},"GetServiceGraph":{"name":"GetServiceGraph","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetServiceGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetServiceGraph"},"GetTimeSeriesServiceStatistics":{"name":"GetTimeSeriesServiceStatistics","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTimeSeriesServiceStatistics.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTimeSeriesServiceStatistics"},"GetTraceGraph":{"name":"GetTraceGraph","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a service graph for one or more specific trace IDs","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceGraph.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceGraph"},"GetTraceSegmentDestination":{"name":"GetTraceSegmentDestination","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSegmentDestination.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceSegmentDestination"},"GetTraceSummaries":{"name":"GetTraceSummaries","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces","accessLevel":"Read","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSummaries.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-GetTraceSummaries"},"Link":{"name":"Link","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to share X-Ray resources with a monitoring account","accessLevel":"Write","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#CloudWatch-Unified-Cross-Account-Setup-permissions","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-Link"},"ListResourcePolicies":{"name":"ListResourcePolicies","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to list resource policies","accessLevel":"List","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_ListResourcePolicies.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListResourcePolicies"},"ListRetrievedTraces":{"name":"ListRetrievedTraces","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group","accessLevel":"List","resourceTypes":[],"operationUrl":"API_ListRetrievedTraces.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListRetrievedTraces"},"ListTagsForResource":{"name":"ListTagsForResource","service":"xray","conditionKeys":[],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to list tags for an X-Ray resource","accessLevel":"List","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_ListTagsForResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-ListTagsForResource"},"PutEncryptionConfig":{"name":"PutEncryptionConfig","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to update the encryption configuration for X-Ray data","accessLevel":"Permissions management","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutEncryptionConfig.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutEncryptionConfig"},"PutResourcePolicy":{"name":"PutResourcePolicy","service":"xray","conditionKeys":["xray:ResourcePolicyName"],"resources":[],"description":"Grants permission to create or update resource policies","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutResourcePolicy.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutResourcePolicy"},"PutSpans":{"name":"PutSpans","service":"xray","conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload OpenTelemetry spans to AWS X-Ray","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutSpans"},"PutSpansForIndexing":{"name":"PutSpansForIndexing","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to upload spans to AWS X-Ray to be indexed","accessLevel":"Write","resourceTypes":[],"permissionOnly":true,"operationUrl":"https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutSpansForIndexing"},"PutTelemetryRecords":{"name":"PutTelemetryRecords","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to send AWS X-Ray daemon telemetry to the service","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutTelemetryRecords.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutTelemetryRecords"},"PutTraceSegments":{"name":"PutTraceSegments","service":"xray","conditionKeys":["logs:LogGeneratingResourceArns"],"resources":[],"description":"Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_PutTraceSegments.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-PutTraceSegments"},"StartTraceRetrieval":{"name":"StartTraceRetrieval","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to initiate a trace retrieval process using the specified time range and for the given trace IDs on the Transaction Search CloudWatch log group","accessLevel":"Read","resourceTypes":[],"operationUrl":"API_StartTraceRetrieval","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-StartTraceRetrieval"},"TagResource":{"name":"TagResource","service":"xray","conditionKeys":["aws:RequestTag/${TagKey}","aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to add tags to an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_TagResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-TagResource"},"UntagResource":{"name":"UntagResource","service":"xray","conditionKeys":["aws:TagKeys"],"resources":[{"name":"group"},{"name":"sampling-rule"}],"description":"Grants permission to remove tags from an X-Ray resource","accessLevel":"Tagging","resourceTypes":[{"name":"group","required":false},{"name":"sampling-rule","required":false}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UntagResource.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UntagResource"},"UpdateGroup":{"name":"UpdateGroup","service":"xray","conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"group"}],"description":"Grants permission to update a group resource","accessLevel":"Write","resourceTypes":[{"name":"group","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateGroup.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateGroup"},"UpdateIndexingRule":{"name":"UpdateIndexingRule","service":"xray","conditionKeys":[],"resources":[],"description":"Grants permission to modify an indexing rule's configuration","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateIndexingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateIndexingRule"},"UpdateSamplingRule":{"name":"UpdateSamplingRule","service":"xray","conditionKeys":["aws:ResourceTag/${TagKey}"],"resources":[{"name":"sampling-rule"}],"description":"Grants permission to modify a sampling rule's configuration","accessLevel":"Write","resourceTypes":[{"name":"sampling-rule","required":true}],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateSamplingRule.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateSamplingRule"},"UpdateTraceSegmentDestination":{"name":"UpdateTraceSegmentDestination","service":"xray","conditionKeys":["xray:TraceSegmentDestination"],"resources":[],"description":"Grants permission to modify the destination of data sent to PutTraceSegments and OpenTelemetry API","accessLevel":"Write","resourceTypes":[],"operationUrl":"https://docs.aws.amazon.com/xray/latest/api/API_UpdateTraceSegmentDestination.html","iamUrl":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html#awsx-ray-UpdateTraceSegmentDestination"}},"resources":[{"name":"group","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]},{"name":"sampling-rule","arnFormats":["arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}"],"conditionKeys":["aws:ResourceTag/${TagKey}"]}],"conditionKeys":{"aws:RequestTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags that are passed in the request"},"aws:ResourceTag/${TagKey}":{"types":["String"],"description":"Filters access by the tags associated with the resource"},"aws:TagKeys":{"types":["ArrayOfString"],"description":"Filters access by the tag keys that are passed in the request"},"logs:LogGeneratingResourceArns":{"types":["ArrayOfARN"],"description":"Filters access by LogGeneratingResourceArn in the request"},"xray:ResourcePolicyName":{"types":["String"],"description":"Filters access by PolicyName in the request"},"xray:TraceSegmentDestination":{"types":["String"],"description":"Filters access by TraceSegmentDestination type in the request"}},"url":"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html"}

package/src/extension.js

@@ -8,12 +8,7 @@ export function activate(context) {
         debug: { module: serverModule, transport: TransportKind.stdio },
     };
     client = new LanguageClient('aws-iam-language-server', 'AWS IAM Language Server', serverOptions, {
-        documentSelector: [
-            { scheme: 'file', language: 'json' },
-            { scheme: 'file', language: 'yaml' },
-            { scheme: 'file', language: 'terraform' },
-            { scheme: 'file', language: 'opentofu' },
-        ],
+        documentSelector: [{ language: 'json' }, { language: 'yaml' }, { language: 'terraform' }, { language: 'opentofu' }],
     });
     client.start();
 }

package/src/handlers/completion/action-value.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ActionValueLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
-export declare function completeActionValue(location: ActionValueLocation, _context: CompletionContext): CompletionList;
+import { type CompletionContext } from './index.ts';
+export declare function completeActionValue(location: ActionValueLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/action-value.js

@@ -1,29 +1,46 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
-export function completeActionValue(location, _context) {
-    const potentialLabels = ServiceReference.getAllActions();
+import { partialRange } from "./index.js";
+export function completeActionValue(location, context) {
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
-    for (const label of potentialLabels) {
-        if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
-            continue;
-        const item = {
-            label,
-            kind: CompletionItemKind.Enum,
-        };
-        const [service, actionName] = label.split(':');
-        if (service && actionName) {
-            const action = ServiceReference.getAction(service, actionName);
-            if (action) {
+    const parts = location.partial.split(':');
+    if (parts.length === 1) {
+        // suggest services
+        const potentialServices = ServiceReference.getAllServices();
+        for (const service of potentialServices) {
+            if (!service.toLowerCase().startsWith(location.partial.toLowerCase()))
+                continue;
+            const item = {
+                label: service,
+                kind: CompletionItemKind.Enum,
+                textEdit: { range, newText: service },
+            };
+            items.push(item);
+        }
+    }
+    else if (parts.length === 2) {
+        // suggest actions
+        const serviceName = parts[0];
+        const potentialActions = ServiceReference.getActionsForService(serviceName);
+        for (const action of potentialActions) {
+            const label = `${action.service}:${action.name}`;
+            if (!label.toLowerCase().startsWith(location.partial.toLowerCase()))
+                continue;
+            const item = {
+                label,
+                kind: CompletionItemKind.Enum,
+                textEdit: { range, newText: label },
+            };
+            if (action.description) {
                 item.detail = action.description;
-                if (action.description) {
-                    item.documentation = {
-                        kind: MarkupKind.Markdown,
-                        value: formatActionDocumentation(action),
-                    };
-                }
+                item.documentation = {
+                    kind: MarkupKind.Markdown,
+                    value: formatActionDocumentation(action),
+                };
             }
+            items.push(item);
         }
-        items.push(item);
     }
     return { items, isIncomplete: false };
 }

package/src/handlers/completion/condition-block.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ConditionBlockLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
+import { type CompletionContext } from './index.ts';
 export declare function completeConditionBlock(location: ConditionBlockLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/condition-block.js

@@ -1,4 +1,5 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { partialRange } from "./index.js";
 const conditionBlockAttributes = {
     test: {
         description: 'The condition operator to evaluate (e.g., `StringEquals`, `ArnLike`, `IpAddress`).',
@@ -12,6 +13,7 @@ const conditionBlockAttributes = {
 };
 export function completeConditionBlock(location, context) {
     const siblingKeys = context.handler.getSiblingKeys(context.uri, context.position);
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [name, attr] of Object.entries(conditionBlockAttributes)) {
         if (siblingKeys.includes(name))
@@ -21,6 +23,7 @@ export function completeConditionBlock(location, context) {
         items.push({
             label: name,
             kind: CompletionItemKind.Field,
+            textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
                 value: attr.description,

package/src/handlers/completion/condition-key.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ConditionKeyLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
+import { type CompletionContext } from './index.ts';
 export declare function completeConditionKey(location: ConditionKeyLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/condition-key.js

@@ -1,9 +1,11 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
 import { expandActionPattern } from "../../lib/iam-policy/wildcard.js";
+import { partialRange } from "./index.js";
 export function completeConditionKey(location, context) {
     const statement = context.handler.getStatementContext(context.uri, context.position);
     const existingKeys = location.operator ? Object.keys(statement?.Condition?.[location.operator] ?? {}) : [];
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     const seen = new Set();
     // Build a lookup for global keys so we can enrich service-specific keys with descriptions
@@ -34,6 +36,7 @@ export function completeConditionKey(location, context) {
             items.push({
                 label: key.name,
                 kind: CompletionItemKind.Property,
+                textEdit: { range, newText: key.name },
                 documentation: {
                     kind: MarkupKind.Markdown,
                     value: formatDocumentation(key.types, global, conditionKeyData),
@@ -53,6 +56,7 @@ export function completeConditionKey(location, context) {
         items.push({
             label: global.name,
             kind: CompletionItemKind.Property,
+            textEdit: { range, newText: global.name },
             documentation: {
                 kind: MarkupKind.Markdown,
                 value: formatDocumentation([], global),

package/src/handlers/completion/condition-operator.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ConditionOperatorLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
+import { type CompletionContext } from './index.ts';
 export declare function completeConditionOperator(location: ConditionOperatorLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/condition-operator.js

@@ -1,8 +1,10 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { conditionOperators } from "../../lib/iam-policy/condition-operators.js";
+import { partialRange } from "./index.js";
 export function completeConditionOperator(location, context) {
     const statement = context.handler.getStatementContext(context.uri, context.position);
     const existingOperators = Object.keys(statement?.Condition ?? {});
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [name, operator] of Object.entries(conditionOperators)) {
         if (existingOperators.includes(name))
@@ -12,6 +14,7 @@ export function completeConditionOperator(location, context) {
         items.push({
             label: name,
             kind: CompletionItemKind.Operator,
+            textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
                 value: operator.description,

package/src/handlers/completion/effect-value.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { EffectValueLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
-export declare function completeEffectValue(location: EffectValueLocation, _context: CompletionContext): CompletionList;
+import { type CompletionContext } from './index.ts';
+export declare function completeEffectValue(location: EffectValueLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/effect-value.js

@@ -1,6 +1,8 @@
 import { CompletionItemKind } from 'vscode-languageserver';
-export function completeEffectValue(location, _context) {
+import { partialRange } from "./index.js";
+export function completeEffectValue(location, context) {
     const potentialLabels = ['Allow', 'Deny'];
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const label of potentialLabels) {
         if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
@@ -8,6 +10,7 @@ export function completeEffectValue(location, _context) {
         items.push({
             label,
             kind: CompletionItemKind.Enum,
+            textEdit: { range, newText: label },
         });
     }
     return { items, isIncomplete: false };

package/src/handlers/completion/index.d.ts

@@ -1,4 +1,4 @@
-import type { CompletionList, CompletionParams } from 'vscode-languageserver';
+import type { CompletionList, CompletionParams, Connection } from 'vscode-languageserver';
 import type { TextDocuments } from 'vscode-languageserver/node.js';
 import type { TextDocument } from 'vscode-languageserver-textdocument';
 import type { TreeBase } from '../../lib/treesitter/base.ts';
@@ -11,4 +11,17 @@ export type CompletionContext = {
         column: number;
     };
 };
-export declare function handleCompletionRequest(params: CompletionParams, _documents: TextDocuments<TextDocument>, treeManager: TreeManager): Promise<CompletionList>;
+export declare function partialRange(position: {
+    line: number;
+    column: number;
+}, partialLength: number): {
+    start: {
+        line: number;
+        character: number;
+    };
+    end: {
+        line: number;
+        character: number;
+    };
+};
+export declare function handleCompletionRequest(params: CompletionParams, _documents: TextDocuments<TextDocument>, treeManager: TreeManager, connection: Connection): Promise<CompletionList>;

package/src/handlers/completion/index.js

@@ -15,7 +15,13 @@ import { completeResourceValue } from "./resource-value.js";
 import { completeStatementBlock } from "./statement-block.js";
 import { completeStatementKey } from "./statement-key.js";
 const emptyResult = { items: [], isIncomplete: false };
-export async function handleCompletionRequest(params, _documents, treeManager) {
+export function partialRange(position, partialLength) {
+    return {
+        start: { line: position.line, character: position.column - partialLength },
+        end: { line: position.line, character: position.column },
+    };
+}
+export async function handleCompletionRequest(params, _documents, treeManager, connection) {
     const handler = treeManager.getLanguageHandler(params.textDocument.uri);
     if (!handler)
         return emptyResult;
@@ -24,12 +30,19 @@ export async function handleCompletionRequest(params, _documents, treeManager) {
     if (!cursorContext)
         return emptyResult;
     const location = resolvePolicyLocation(cursorContext);
+    connection.console.debug(`Completion debug: ${JSON.stringify({
+        uri: params.textDocument.uri,
+        cursorContext,
+        location,
+        position: params.position,
+    })}`);
     const result = handleLocationCompletion(location, {
         handler,
         uri: params.textDocument.uri,
         position,
     });
     result.items = result.items.map(toSnippet);
+    connection.console.debug(`Found ${result.items.length} completion items for ${params.textDocument.uri} at line ${position.line}, column ${position.column}`);
     return result;
 }
 function handleLocationCompletion(location, context) {
@@ -78,7 +91,7 @@ function handleLocationCompletion(location, context) {
     return emptyResult;
 }
 function toSnippet(item) {
-    const text = item.insertText ?? item.label;
+    const text = item.textEdit && 'range' in item.textEdit ? item.textEdit.newText : (item.insertText ?? item.label);
     const snippetPlaceholderPattern = /\$\{([^}]+)\}/g;
     if (!snippetPlaceholderPattern.test(text))
         return item;
@@ -90,7 +103,12 @@ function toSnippet(item) {
         }
         return `\${${seen.get(name)}:${name}}`;
     });
-    item.insertText = snippetText;
+    if (item.textEdit && 'range' in item.textEdit) {
+        item.textEdit.newText = snippetText;
+    }
+    else {
+        item.insertText = snippetText;
+    }
     item.insertTextFormat = InsertTextFormat.Snippet;
     return item;
 }

package/src/handlers/completion/principal-block-identifier.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalBlockIdentifierLocation } from '../../lib/iam-policy/location.ts';
 import type { CompletionContext } from './index.ts';
-export declare function completePrincipalBlockIdentifier(location: PrincipalBlockIdentifierLocation, _context: CompletionContext): CompletionList;
+export declare function completePrincipalBlockIdentifier(location: PrincipalBlockIdentifierLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block-identifier.js

@@ -1,4 +1,4 @@
 import { completePrincipalIdentifier } from "./principal-identifier-completions.js";
-export function completePrincipalBlockIdentifier(location, _context) {
-    return completePrincipalIdentifier(location.principalType, location.partial);
+export function completePrincipalBlockIdentifier(location, context) {
+    return completePrincipalIdentifier(location.principalType, location.partial, context.position);
 }

package/src/handlers/completion/principal-block-type.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalBlockTypeLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
-export declare function completePrincipalBlockType(location: PrincipalBlockTypeLocation, _context: CompletionContext): CompletionList;
+import { type CompletionContext } from './index.ts';
+export declare function completePrincipalBlockType(location: PrincipalBlockTypeLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block-type.js

@@ -1,6 +1,8 @@
 import { CompletionItemKind } from 'vscode-languageserver';
 import { principalTypes } from "../../lib/iam-policy/principals.js";
-export function completePrincipalBlockType(location, _context) {
+import { partialRange } from "./index.js";
+export function completePrincipalBlockType(location, context) {
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [_id, principalType] of Object.entries(Object.assign({}, principalTypes, {
         '*': {
@@ -14,6 +16,7 @@ export function completePrincipalBlockType(location, _context) {
         items.push({
             label: principalType.value,
             kind: CompletionItemKind.Enum,
+            textEdit: { range, newText: principalType.value },
             documentation: {
                 kind: 'markdown',
                 value: principalType.description,

package/src/handlers/completion/principal-block.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalBlockLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
+import { type CompletionContext } from './index.ts';
 export declare function completePrincipalBlock(location: PrincipalBlockLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block.js

@@ -1,4 +1,5 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { partialRange } from "./index.js";
 const principalBlockAttributes = {
     type: {
         description: 'The type of principal. Valid values: `*`, `AWS`, `Service`, `Federated`, `CanonicalUser`.',
@@ -9,6 +10,7 @@ const principalBlockAttributes = {
 };
 export function completePrincipalBlock(location, context) {
     const siblingKeys = context.handler.getSiblingKeys(context.uri, context.position);
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [name, attr] of Object.entries(principalBlockAttributes)) {
         if (siblingKeys.includes(name))
@@ -18,6 +20,7 @@ export function completePrincipalBlock(location, context) {
         items.push({
             label: name,
             kind: CompletionItemKind.Field,
+            textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
                 value: attr.description,

package/src/handlers/completion/principal-identifier-completions.d.ts

@@ -1,2 +1,5 @@
 import type { CompletionList } from 'vscode-languageserver';
-export declare function completePrincipalIdentifier(principalType: string | null, partial: string): CompletionList;
+export declare function completePrincipalIdentifier(principalType: string | null, partial: string, position: {
+    line: number;
+    column: number;
+}): CompletionList;

package/src/handlers/completion/principal-identifier-completions.js

@@ -1,6 +1,7 @@
 import { CompletionItemKind } from 'vscode-languageserver';
 import { partitions } from "../../lib/iam-policy/partitions.js";
 import { principalTypes } from "../../lib/iam-policy/principals.js";
+import { partialRange } from "./index.js";
 const PARTITION_PLACEHOLDER = `\${Partition}`;
 const REGION_PLACEHOLDER = `\${Region}`;
 const ACCOUNT_PLACEHOLDER = `\${Account}`;
@@ -24,27 +25,28 @@ function getPatternsForType(principalType) {
             return null;
     }
 }
-export function completePrincipalIdentifier(principalType, partial) {
+export function completePrincipalIdentifier(principalType, partial, position) {
     if (!principalType)
         return { items: [], isIncomplete: false };
     const config = getPatternsForType(principalType);
     if (!config)
         return { items: [], isIncomplete: false };
+    const range = partialRange(position, partial.length);
     const items = [];
     if (!partial) {
         for (const pattern of [...config.nonArn, ...config.arn]) {
-            items.push({ label: pattern, kind: CompletionItemKind.Value });
+            items.push({ label: pattern, kind: CompletionItemKind.Value, textEdit: { range, newText: pattern } });
         }
         return { items, isIncomplete: false };
     }
     const parts = partial.split(':');
     if (parts.length === 1) {
         if (config.arn.length > 0 && 'arn'.startsWith(partial.toLowerCase())) {
-            items.push({ label: 'arn', kind: CompletionItemKind.Constant });
+            items.push({ label: 'arn', kind: CompletionItemKind.Constant, textEdit: { range, newText: 'arn' } });
         }
         for (const pattern of config.nonArn) {
             if (pattern.toLowerCase().startsWith(partial.toLowerCase())) {
-                items.push({ label: pattern, kind: CompletionItemKind.Value });
+                items.push({ label: pattern, kind: CompletionItemKind.Value, textEdit: { range, newText: pattern } });
             }
         }
     }
@@ -97,9 +99,11 @@ export function completePrincipalIdentifier(principalType, partial) {
         }
     }
     else if (parts.length === 5) {
+        const label = `${partial}:`;
         items.push({
-            label: `${partial}:`,
+            label,
             kind: CompletionItemKind.Enum,
+            textEdit: { range, newText: label },
             documentation: { kind: 'markdown', value: 'AWS Account ID' },
         });
     }
@@ -124,7 +128,7 @@ export function completePrincipalIdentifier(principalType, partial) {
                 .replace(ACCOUNT_PLACEHOLDER, account);
             if (!label.toLowerCase().startsWith(partial.toLowerCase()))
                 continue;
-            items.push({ label, kind: CompletionItemKind.Value });
+            items.push({ label, kind: CompletionItemKind.Value, textEdit: { range, newText: label } });
         }
     }
     return { items, isIncomplete: false };

package/src/handlers/completion/principal-type.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalTypeLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
+import { type CompletionContext } from './index.ts';
 export declare function completePrincipalType(location: PrincipalTypeLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-type.js

@@ -1,9 +1,11 @@
 import { CompletionItemKind } from 'vscode-languageserver';
 import { principalTypes } from "../../lib/iam-policy/principals.js";
+import { partialRange } from "./index.js";
 export function completePrincipalType(location, context) {
     const statement = context.handler.getStatementContext(context.uri, context.position);
     const principal = statement?.Principal ?? statement?.NotPrincipal;
     const existingTypes = principal && typeof principal === 'object' ? Object.keys(principal) : [];
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [_id, principalType] of Object.entries(principalTypes)) {
         if (existingTypes.includes(principalType.value))
@@ -13,6 +15,7 @@ export function completePrincipalType(location, context) {
         items.push({
             label: principalType.value,
             kind: CompletionItemKind.Enum,
+            textEdit: { range, newText: principalType.value },
             documentation: {
                 kind: 'markdown',
                 value: principalType.description,

package/src/handlers/completion/principal-typed-value.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalTypedValueLocation } from '../../lib/iam-policy/location.ts';
 import type { CompletionContext } from './index.ts';
-export declare function completePrincipalTypedValue(location: PrincipalTypedValueLocation, _context: CompletionContext): CompletionList;
+export declare function completePrincipalTypedValue(location: PrincipalTypedValueLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-typed-value.js

@@ -1,4 +1,4 @@
 import { completePrincipalIdentifier } from "./principal-identifier-completions.js";
-export function completePrincipalTypedValue(location, _context) {
-    return completePrincipalIdentifier(location.principalType, location.partial);
+export function completePrincipalTypedValue(location, context) {
+    return completePrincipalIdentifier(location.principalType, location.partial, context.position);
 }

package/src/handlers/completion/principal-value.d.ts

@@ -1,4 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { PrincipalValueLocation } from '../../lib/iam-policy/location.ts';
-import type { CompletionContext } from './index.ts';
-export declare function completePrincipalValue(location: PrincipalValueLocation, _context: CompletionContext): CompletionList;
+import { type CompletionContext } from './index.ts';
+export declare function completePrincipalValue(location: PrincipalValueLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-value.js

@@ -1,6 +1,8 @@
 import { CompletionItemKind } from 'vscode-languageserver';
-export function completePrincipalValue(location, _context) {
+import { partialRange } from "./index.js";
+export function completePrincipalValue(location, context) {
     const potentialLabels = ['*'];
+    const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const label of potentialLabels) {
         if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
@@ -8,6 +10,7 @@ export function completePrincipalValue(location, _context) {
         items.push({
             label,
             kind: CompletionItemKind.Enum,
+            textEdit: { range, newText: label },
             documentation: {
                 kind: 'markdown',
                 value: 'Public Unauthenticated Access',