iamdata 0.1.202505111__py3-none-any.whl → 0.1.202512121__py3-none-any.whl

iamdata/data/actions/s3.json

@@ -4,18 +4,21 @@
     "description": "Grants permission to abort a multipart upload",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointArn",
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -28,7 +31,7 @@
   "associateaccessgrantsidentitycenter": {
     "name": "AssociateAccessGrantsIdentityCenter",
     "description": "Grants permission to associate Access Grants identity center",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -53,17 +56,20 @@
     "description": "Grants permission to allow circumvention of governance-mode object retention settings",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
       "s3:authType",
@@ -91,7 +97,7 @@
   "createaccessgrant": {
     "name": "CreateAccessGrant",
     "description": "Grants permission to create Access Grant",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -101,6 +107,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -116,7 +123,7 @@
   "createaccessgrantsinstance": {
     "name": "CreateAccessGrantsInstance",
     "description": "Grants permission to Create Access Grants Instance",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -141,7 +148,7 @@
   "createaccessgrantslocation": {
     "name": "CreateAccessGrantsLocation",
     "description": "Grants permission to create Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -151,6 +158,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -186,7 +194,11 @@
       "s3:signatureversion",
       "s3:TlsVersion",
       "s3:x-amz-acl",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:RequestTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
@@ -241,13 +253,15 @@
       "s3:x-amz-grant-read-acp",
       "s3:x-amz-grant-write",
       "s3:x-amz-grant-write-acp",
-      "s3:x-amz-object-ownership"
+      "s3:x-amz-object-ownership",
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
     ],
     "dependentActions": []
   },
   "createbucketmetadatatableconfiguration": {
     "name": "CreateBucketMetadataTableConfiguration",
-    "description": "Grants permission to create a new S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to create a new S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Write",
     "resourceTypes": [
       {
@@ -255,9 +269,13 @@
         "required": true,
         "conditionKeys": [],
         "dependentActions": [
+          "kms:DescribeKey",
           "s3tables:CreateNamespace",
           "s3tables:CreateTable",
+          "s3tables:CreateTableBucket",
           "s3tables:GetTable",
+          "s3tables:PutTableBucketPolicy",
+          "s3tables:PutTableEncryption",
           "s3tables:PutTablePolicy"
         ]
       }
@@ -337,7 +355,7 @@
   "deleteaccessgrant": {
     "name": "DeleteAccessGrant",
     "description": "Grants permission to delete Access Grant",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrant",
@@ -347,6 +365,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -360,7 +379,7 @@
   "deleteaccessgrantsinstance": {
     "name": "DeleteAccessGrantsInstance",
     "description": "Grants permission to Delete Access Grants Instance",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -383,7 +402,7 @@
   "deleteaccessgrantsinstanceresourcepolicy": {
     "name": "DeleteAccessGrantsInstanceResourcePolicy",
     "description": "Grants permission to read Access grants instance resource policy",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -406,7 +425,7 @@
   "deleteaccessgrantslocation": {
     "name": "DeleteAccessGrantsLocation",
     "description": "Grants permission to delete Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -416,6 +435,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -447,7 +467,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -497,7 +519,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -550,7 +574,7 @@
   },
   "deletebucketmetadatatableconfiguration": {
     "name": "DeleteBucketMetadataTableConfiguration",
-    "description": "Grants permission to delete the S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to delete the S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Write",
     "resourceTypes": [
       {
@@ -667,24 +691,28 @@
     "description": "Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:if-match"
     ],
     "dependentActions": []
   },
@@ -693,17 +721,20 @@
     "description": "Grants permission to use the tagging subresource to remove the entire tag set from the specified object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -719,18 +750,21 @@
     "description": "Grants permission to remove a specific version of an object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -746,17 +780,20 @@
     "description": "Grants permission to remove the entire tag set for a specific version of the object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -880,7 +917,7 @@
   "dissociateaccessgrantsidentitycenter": {
     "name": "DissociateAccessGrantsIdentityCenter",
     "description": "Grants permission to disassociate Access Grants identity center",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -935,6 +972,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1027,6 +1065,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1051,7 +1090,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1126,7 +1167,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1176,7 +1219,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -1242,14 +1287,42 @@
     ],
     "dependentActions": []
   },
+  "getbucketabac": {
+    "name": "GetBucketAbac",
+    "description": "Grants permission to retrieve ABAC configuration for a general purpose bucket",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "getbucketacl": {
     "name": "GetBucketAcl",
     "description": "Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1269,9 +1342,15 @@
     "description": "Grants permission to return the CORS configuration information set for an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1291,9 +1370,15 @@
     "description": "Grants permission to return the Region that an Amazon S3 bucket resides in",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1332,7 +1417,7 @@
   },
   "getbucketmetadatatableconfiguration": {
     "name": "GetBucketMetadataTableConfiguration",
-    "description": "Grants permission to return the S3 Metadata configuration for a specified bucket",
+    "description": "Grants permission to return the S3 Metadata configuration for a specified general purpose bucket",
     "accessLevel": "Read",
     "resourceTypes": [
       {
@@ -1357,9 +1442,15 @@
     "description": "Grants permission to get the notification configuration of an Amazon S3 bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1423,9 +1514,15 @@
     "description": "Grants permission to return the policy of the specified bucket",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
@@ -1828,27 +1925,28 @@
     "description": "Grants permission to retrieve objects from Amazon S3",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256",
-      "s3:if-match",
-      "s3:if-none-match"
+      "s3:x-amz-content-sha256"
     ],
     "dependentActions": []
   },
@@ -1857,18 +1955,21 @@
     "description": "Grants permission to return the access control list (ACL) of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -1885,22 +1986,19 @@
     "accessLevel": "Read",
     "resourceTypes": [
       {
-        "name": "accesspoint",
-        "required": true,
+        "name": "accesspointobject",
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -1916,17 +2014,20 @@
     "description": "Grants permission to get an object's current Legal Hold status",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1941,17 +2042,20 @@
     "description": "Grants permission to retrieve the retention settings for an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -1966,17 +2070,20 @@
     "description": "Grants permission to return the tag set of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2014,18 +2121,21 @@
     "description": "Grants permission to retrieve a specific version of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2042,18 +2152,21 @@
     "description": "Grants permission to return the access control list (ACL) of a specific object version",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2070,17 +2183,20 @@
     "description": "Grants permission to retrieve attributes related to a specific version of an object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2119,17 +2235,20 @@
     "description": "Grants permission to return the tag set for a specific version of the object",
     "accessLevel": "Read",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -2403,18 +2522,21 @@
     "description": "Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000)",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:delimiter",
       "s3:max-keys",
@@ -2449,7 +2571,9 @@
       "s3:signatureAge",
       "s3:signatureversion",
       "s3:TlsVersion",
-      "s3:x-amz-content-sha256"
+      "s3:x-amz-content-sha256",
+      "s3:AccessPointTag/${TagKey}",
+      "aws:ResourceTag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -2458,18 +2582,21 @@
     "description": "Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "bucket",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:delimiter",
       "s3:max-keys",
@@ -2539,18 +2666,21 @@
     "description": "Grants permission to list the parts that have been uploaded for a specific multipart upload",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -2613,6 +2743,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "bucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -2704,7 +2846,7 @@
   "putaccessgrantsinstanceresourcepolicy": {
     "name": "PutAccessGrantsInstanceResourcePolicy",
     "description": "Grants permission to put Access grants instance resource policy",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantsinstance",
@@ -2762,9 +2904,6 @@
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -2844,6 +2983,28 @@
     ],
     "dependentActions": []
   },
+  "putbucketabac": {
+    "name": "PutBucketAbac",
+    "description": "Grants permission to set ABAC configuration for a general purpose bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "putbucketacl": {
     "name": "PutBucketAcl",
     "description": "Grants permission to set the permissions on an existing bucket using access control lists (ACLs)",
@@ -3279,18 +3440,21 @@
     "description": "Grants permission to add an object to a bucket",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
       "s3:authType",
@@ -3327,18 +3491,21 @@
     "description": "Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -3361,17 +3528,20 @@
     "description": "Grants permission to apply a Legal Hold configuration to the specified object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3387,17 +3557,20 @@
     "description": "Grants permission to place an Object Retention configuration on an object",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3415,17 +3588,20 @@
     "description": "Grants permission to set the supplied tag-set to an object that already exists in a bucket",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
@@ -3443,18 +3619,21 @@
     "description": "Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket",
     "accessLevel": "Permissions management",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
       "s3:AccessGrantsInstanceArn",
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:authType",
       "s3:ResourceAccount",
@@ -3478,17 +3657,20 @@
     "description": "Grants permission to set the supplied tag-set for a specific version of an object",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:ExistingObjectTag/<key>",
       "s3:RequestObjectTag/<key>",
       "s3:RequestObjectTagKeys",
@@ -3642,17 +3824,20 @@
     "description": "Grants permission to restore an archived copy of an object back into Amazon S3",
     "accessLevel": "Write",
     "resourceTypes": [
+      {
+        "name": "accesspointobject",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "object",
-        "required": true,
+        "required": false,
         "conditionKeys": [],
         "dependentActions": []
       }
     ],
     "conditionKeys": [
-      "s3:DataAccessPointAccount",
-      "s3:DataAccessPointArn",
-      "s3:AccessPointNetworkOrigin",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3709,6 +3894,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "bucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -3751,6 +3948,18 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "accesspoint",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "bucket",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "storagelensgroup",
         "required": false,
@@ -3772,7 +3981,7 @@
   "updateaccessgrantslocation": {
     "name": "UpdateAccessGrantsLocation",
     "description": "Grants permission to update Access Grants location",
-    "accessLevel": "Write",
+    "accessLevel": "Permissions management",
     "resourceTypes": [
       {
         "name": "accessgrantslocation",
@@ -3782,6 +3991,7 @@
       }
     ],
     "conditionKeys": [
+      "s3:AccessGrantsLocationScope",
       "s3:authType",
       "s3:ResourceAccount",
       "s3:signatureAge",
@@ -3792,6 +4002,58 @@
     ],
     "dependentActions": []
   },
+  "updatebucketmetadatainventorytableconfiguration": {
+    "name": "UpdateBucketMetadataInventoryTableConfiguration",
+    "description": "Grants permission to update the inventory table configuration on an existing S3 Metadata configuration for a specified general purpose bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": [
+          "kms:DescribeKey",
+          "s3tables:CreateNamespace",
+          "s3tables:CreateTable",
+          "s3tables:CreateTableBucket",
+          "s3tables:GetTable",
+          "s3tables:PutTableEncryption",
+          "s3tables:PutTablePolicy"
+        ]
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
+  "updatebucketmetadatajournaltableconfiguration": {
+    "name": "UpdateBucketMetadataJournalTableConfiguration",
+    "description": "Grants permission to update the journal table configuration on an existing S3 Metadata configuration for a specified general purpose bucket",
+    "accessLevel": "Write",
+    "resourceTypes": [
+      {
+        "name": "bucket",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "s3:authType",
+      "s3:ResourceAccount",
+      "s3:signatureAge",
+      "s3:signatureversion",
+      "s3:TlsVersion",
+      "s3:x-amz-content-sha256"
+    ],
+    "dependentActions": []
+  },
   "updatejobpriority": {
     "name": "UpdateJobPriority",
     "description": "Grants permission to update the priority of an existing job",