iamdata 0.1.202505111__py3-none-any.whl → 0.1.202511181__py3-none-any.whl

iamdata/data/actions/s3.json

@@ -4,18 +4,21 @@
     "description": "Grants permission to abort a multipart upload",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointArn",
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -28,7 +31,7 @@
   "associateaccessgrantsidentitycenter": {
     "name": "AssociateAccessGrantsIdentityCenter",
     "description": "Grants permission to associate Access Grants identity center",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -53,17 +56,20 @@
     "description": "Grants permission to allow circumvention of governance-mode object retention settings",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
       "s3:authType",
@@ -91,7 +97,7 @@
   "createaccessgrant": {
     "name": "CreateAccessGrant",
     "description": "Grants permission to create Access Grant",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -101,6 +107,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -116,7 +123,7 @@
   "createaccessgrantsinstance": {
     "name": "CreateAccessGrantsInstance",
     "description": "Grants permission to Create Access Grants Instance",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -141,7 +148,7 @@
   "createaccessgrantslocation": {
     "name": "CreateAccessGrantsLocation",
     "description": "Grants permission to create Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -151,6 +158,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -186,7 +194,11 @@
       "s3:signatureversion",
       "s3:TlsVersion",
       "s3:x-amz-acl",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -247,7 +259,7 @@
   },
   "createbucketmetadatatableconfiguration": {
     "name": "CreateBucketMetadataTableConfiguration",
-    "description": "Grants permission to create a new S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to create a new S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Write",
     "resourceTypes": [
       {
@@ -255,9 +267,12 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": [
+          "kms:DescribeKey",
           "s3tables:CreateNamespace",
           "s3tables:CreateTable",
+          "s3tables:CreateTableBucket",
           "s3tables:GetTable",
+          "s3tables:PutTableEncryption",
           "s3tables:PutTablePolicy"
         ]
       }
@@ -337,7 +352,7 @@
   "deleteaccessgrant": {
     "name": "DeleteAccessGrant",
     "description": "Grants permission to delete Access Grant",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrant",
@@ -347,6 +362,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -360,7 +376,7 @@
   "deleteaccessgrantsinstance": {
     "name": "DeleteAccessGrantsInstance",
     "description": "Grants permission to Delete Access Grants Instance",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -383,7 +399,7 @@
   "deleteaccessgrantsinstanceresourcepolicy": {
     "name": "DeleteAccessGrantsInstanceResourcePolicy",
     "description": "Grants permission to read Access grants instance resource policy",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -406,7 +422,7 @@
   "deleteaccessgrantslocation": {
     "name": "DeleteAccessGrantsLocation",
     "description": "Grants permission to delete Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -416,6 +432,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -447,7 +464,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -497,7 +516,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -550,7 +571,7 @@
   },
   "deletebucketmetadatatableconfiguration": {
     "name": "DeleteBucketMetadataTableConfiguration",
-    "description": "Grants permission to delete the S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to delete the S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Write",
     "resourceTypes": [
       {
@@ -667,24 +688,28 @@
     "description": "Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:if-match"
     ],
     "dependentActions": []
   },
@@ -693,17 +718,20 @@
     "description": "Grants permission to use the tagging subresource to remove the entire tag set from the specified object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -719,18 +747,21 @@
     "description": "Grants permission to remove a specific version of an object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -746,17 +777,20 @@
     "description": "Grants permission to remove the entire tag set for a specific version of the object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -880,7 +914,7 @@
   "dissociateaccessgrantsidentitycenter": {
     "name": "DissociateAccessGrantsIdentityCenter",
     "description": "Grants permission to disassociate Access Grants identity center",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -935,6 +969,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1027,6 +1062,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1051,7 +1087,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1126,7 +1164,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1176,7 +1216,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1247,9 +1289,15 @@
     "description": "Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1269,9 +1317,15 @@
     "description": "Grants permission to return the CORS configuration information set for an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1291,9 +1345,15 @@
     "description": "Grants permission to return the Region that an Amazon S3 bucket resides in",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1332,7 +1392,7 @@
   },
   "getbucketmetadatatableconfiguration": {
     "name": "GetBucketMetadataTableConfiguration",
-    "description": "Grants permission to return the S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to return the S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Read",
     "resourceTypes": [
       {
@@ -1357,9 +1417,15 @@
     "description": "Grants permission to get the notification configuration of an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1423,9 +1489,15 @@
     "description": "Grants permission to return the policy of the specified bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1828,27 +1900,28 @@
     "description": "Grants permission to retrieve objects from Amazon S3",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256",
-      "s3:if-match",
-      "s3:if-none-match"
+      "s3:x-amz-content-sha256"
     ],
     "dependentActions": []
   },
@@ -1857,18 +1930,21 @@
     "description": "Grants permission to return the access control list (ACL) of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -1885,22 +1961,19 @@
     "accessLevel": "Read",
     "resourceTypes": [
       {
-        "name": "accesspoint",
-        "required": true,
+        "name": "accesspointobject",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -1916,17 +1989,20 @@
     "description": "Grants permission to get an object's current Legal Hold status",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1941,17 +2017,20 @@
     "description": "Grants permission to retrieve the retention settings for an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1966,17 +2045,20 @@
     "description": "Grants permission to return the tag set of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2014,18 +2096,21 @@
     "description": "Grants permission to retrieve a specific version of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2042,18 +2127,21 @@
     "description": "Grants permission to return the access control list (ACL) of a specific object version",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2070,17 +2158,20 @@
     "description": "Grants permission to retrieve attributes related to a specific version of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2119,17 +2210,20 @@
     "description": "Grants permission to return the tag set for a specific version of the object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2403,18 +2497,21 @@
     "description": "Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000)",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:delimiter",
       "s3:max-keys",
@@ -2449,7 +2546,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -2458,18 +2557,21 @@
     "description": "Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:delimiter",
       "s3:max-keys",
@@ -2539,18 +2641,21 @@
     "description": "Grants permission to list the parts that have been uploaded for a specific multipart upload",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -2613,6 +2718,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -2704,7 +2815,7 @@
   "putaccessgrantsinstanceresourcepolicy": {
     "name": "PutAccessGrantsInstanceResourcePolicy",
     "description": "Grants permission to put Access grants instance resource policy",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -2762,9 +2873,6 @@
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3279,18 +3387,21 @@
     "description": "Grants permission to add an object to a bucket",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
       "s3:authType",
@@ -3327,18 +3438,21 @@
     "description": "Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -3361,17 +3475,20 @@
     "description": "Grants permission to apply a Legal Hold configuration to the specified object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3387,17 +3504,20 @@
     "description": "Grants permission to place an Object Retention configuration on an object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3415,17 +3535,20 @@
     "description": "Grants permission to set the supplied tag-set to an object that already exists in a bucket",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
@@ -3443,18 +3566,21 @@
     "description": "Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -3478,17 +3604,20 @@
     "description": "Grants permission to set the supplied tag-set for a specific version of an object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
@@ -3642,17 +3771,20 @@
     "description": "Grants permission to restore an archived copy of an object back into Amazon S3",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3709,6 +3841,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -3751,6 +3889,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -3772,7 +3916,7 @@
   "updateaccessgrantslocation": {
     "name": "UpdateAccessGrantsLocation",
     "description": "Grants permission to update Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -3782,6 +3926,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3792,6 +3937,58 @@
     ],
     "dependentActions": []
   },
+  "updatebucketmetadatainventorytableconfiguration": {
+    "name": "UpdateBucketMetadataInventoryTableConfiguration",
+    "description": "Grants permission to update the inventory table configuration on an existing S3 Metadata configuration for a specified general purpose bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "kms:DescribeKey",
+          "s3tables:CreateNamespace",
+          "s3tables:CreateTable",
+          "s3tables:CreateTableBucket",
+          "s3tables:GetTable",
+          "s3tables:PutTableEncryption",
+          "s3tables:PutTablePolicy"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
+  "updatebucketmetadatajournaltableconfiguration": {
+    "name": "UpdateBucketMetadataJournalTableConfiguration",
+    "description": "Grants permission to update the journal table configuration on an existing S3 Metadata configuration for a specified general purpose bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "updatejobpriority": {
     "name": "UpdateJobPriority",
     "description": "Grants permission to update the priority of an existing job",