iamdata 0.1.202510131__tar.gz → 0.1.202510151__tar.gz

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iamdata
-Version: 0.1.202510131
+Version: 0.1.202510151
 Summary: IAM data for AWS actions, resources, and conditions based on IAM policy documents. Checked for updates daily.
 Project-URL: Homepage, https://github.com/cloud-copilot/iam-data-python
 Project-URL: Issues, https://github.com/cloud-copilot/iam-data-python/issues

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/actions/bedrock-agentcore.json

@@ -64,6 +64,46 @@
     ],
     "dependentActions": []
   },
+  "completeresourcetokenauth": {
+    "name": "CompleteResourceTokenAuth",
+    "description": "Grants permission to retrieve access token with OAuth2 for 3LO flow to access external resource",
+    "accessLevel": "Read",
+    "resourceTypes": [
+      {
+        "name": "oauth2credentialprovider",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
+    "conditionKeys": [
+      "bedrock-agentcore:InboundJwtClaim/iss",
+      "bedrock-agentcore:InboundJwtClaim/sub",
+      "bedrock-agentcore:InboundJwtClaim/aud",
+      "bedrock-agentcore:InboundJwtClaim/scope",
+      "bedrock-agentcore:InboundJwtClaim/client_id",
+      "bedrock-agentcore:userid"
+    ],
+    "dependentActions": []
+  },
   "connectbrowserautomationstream": {
     "name": "ConnectBrowserAutomationStream",
     "description": "Grants permission to connect to a browser automation stream",
@@ -129,7 +169,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createbrowser": {
@@ -231,7 +274,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "createworkloadidentity": {
@@ -252,7 +298,10 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "aws:RequestTag/${TagKey}",
+      "aws:TagKeys"
+    ],
     "dependentActions": []
   },
   "deleteagentruntime": {
@@ -831,7 +880,13 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "bedrock-agentcore:InboundJwtClaim/iss",
+      "bedrock-agentcore:InboundJwtClaim/sub",
+      "bedrock-agentcore:InboundJwtClaim/aud",
+      "bedrock-agentcore:InboundJwtClaim/scope",
+      "bedrock-agentcore:InboundJwtClaim/client_id"
+    ],
     "dependentActions": []
   },
   "getworkloadaccesstokenforuserid": {
@@ -852,7 +907,9 @@
         "dependentActions": []
       }
     ],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "bedrock-agentcore:userid"
+    ],
     "dependentActions": []
   },
   "getworkloadidentity": {
@@ -1170,6 +1227,12 @@
     "description": "Grants permission to list tags for a Bedrock-AgentCore resource",
     "accessLevel": "List",
     "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "browser-custom",
         "required": false,
@@ -1194,6 +1257,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,
@@ -1205,6 +1274,24 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [],
@@ -1390,6 +1477,12 @@
     "description": "Grants permission to Tag a Bedrock-AgentCore resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "browser-custom",
         "required": false,
@@ -1414,6 +1507,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,
@@ -1425,6 +1524,24 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [
@@ -1438,6 +1555,12 @@
     "description": "Grants permission to Untag a Bedrock-AgentCore resource",
     "accessLevel": "Tagging",
     "resourceTypes": [
+      {
+        "name": "apikeycredentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "browser-custom",
         "required": false,
@@ -1462,6 +1585,12 @@
         "conditionKeys": [],
         "dependentActions": []
       },
+      {
+        "name": "oauth2credentialprovider",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
       {
         "name": "runtime",
         "required": false,
@@ -1473,6 +1602,24 @@
         "required": false,
         "conditionKeys": [],
         "dependentActions": []
+      },
+      {
+        "name": "token-vault",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
+      },
+      {
+        "name": "workload-identity-directory",
+        "required": false,
+        "conditionKeys": [],
+        "dependentActions": []
       }
     ],
     "conditionKeys": [

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/actions/rds.json

@@ -284,7 +284,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -304,7 +305,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -324,7 +326,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -346,6 +349,7 @@
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
+      "rds:req-tag/${TagKey}",
       "rds:CopyOptionGroup"
     ],
     "dependentActions": []
@@ -366,7 +370,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -450,7 +455,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -543,7 +549,8 @@
     "conditionKeys": [
       "rds:EndpointType",
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -809,6 +816,7 @@
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
+      "rds:req-tag/${TagKey}",
       "rds:PubliclyAccessible"
     ],
     "dependentActions": []
@@ -905,7 +913,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },
@@ -982,6 +991,7 @@
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
       "aws:TagKeys",
+      "rds:req-tag/${TagKey}",
       "rds:TenantDatabaseName",
       "rds:ManageMasterUserPassword"
     ],
@@ -2778,7 +2788,8 @@
     ],
     "conditionKeys": [
       "aws:RequestTag/${TagKey}",
-      "aws:TagKeys"
+      "aws:TagKeys",
+      "rds:req-tag/${TagKey}"
     ],
     "dependentActions": []
   },

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/actions/servicequotas.json

@@ -56,6 +56,14 @@
       "organizations:DescribeOrganization"
     ]
   },
+  "getautomanagementconfiguration": {
+    "name": "GetAutoManagementConfiguration",
+    "description": "Grants permission to retrieve the automatic management of Service Quotas configuration, including notification settings, opt-in type, and excluded quotas",
+    "accessLevel": "Read",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "getrequestedservicequotachange": {
     "name": "GetRequestedServiceQuotaChange",
     "description": "Grants permission to retrieve the details for a particular service quota increase request",
@@ -194,6 +202,22 @@
     ],
     "dependentActions": []
   },
+  "startautomanagement": {
+    "name": "StartAutoManagement",
+    "description": "Grants permission to enable automatic management of Service Quotas for an AWS account, including notification preferences and excluded quotas configurations",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
+  "stopautomanagement": {
+    "name": "StopAutoManagement",
+    "description": "Grants permission to stop automatic management of Service Quotas for an AWS account and remove all associated configurations",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
+  },
   "tagresource": {
     "name": "TagResource",
     "description": "Grants permission to associate a set of tags with an existing SQ resource",
@@ -214,5 +238,13 @@
       "aws:TagKeys"
     ],
     "dependentActions": []
+  },
+  "updateautomanagement": {
+    "name": "UpdateAutoManagement",
+    "description": "Grants permission to update the automatic management of Service Quotas configuration, including notification preferences and excluded quotas",
+    "accessLevel": "Write",
+    "resourceTypes": [],
+    "conditionKeys": [],
+    "dependentActions": []
   }
 }

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/actions/social-messaging.json

@@ -15,7 +15,14 @@
     "name": "CreateWhatsAppMessageTemplate",
     "description": "Grants permission to create a WhatsApp message template",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -23,7 +30,14 @@
     "name": "CreateWhatsAppMessageTemplateFromLibrary",
     "description": "Grants permission to create a WhatsApp message template from Meta's template library",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -31,7 +45,14 @@
     "name": "CreateWhatsAppMessageTemplateMedia",
     "description": "Grants permission to create media for WhatsApp message templates",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -54,7 +75,14 @@
     "name": "DeleteWhatsAppMessageTemplate",
     "description": "Grants permission to delete a WhatsApp message template",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -122,7 +150,14 @@
     "name": "GetWhatsAppMessageTemplate",
     "description": "Grants permission to get details of a WhatsApp message template",
     "accessLevel": "Read",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -159,7 +194,14 @@
     "name": "ListWhatsAppMessageTemplates",
     "description": "Grants permission to list WhatsApp message templates",
     "accessLevel": "List",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -167,7 +209,14 @@
     "name": "ListWhatsAppTemplateLibrary",
     "description": "Grants permission to list available templates from Meta's template library",
     "accessLevel": "List",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   },
@@ -269,7 +318,14 @@
     "name": "UpdateWhatsAppMessageTemplate",
     "description": "Grants permission to update a WhatsApp message template",
     "accessLevel": "Write",
-    "resourceTypes": [],
+    "resourceTypes": [
+      {
+        "name": "waba",
+        "required": true,
+        "conditionKeys": [],
+        "dependentActions": []
+      }
+    ],
     "conditionKeys": [],
     "dependentActions": []
   }

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/actions/xray.json

@@ -327,7 +327,9 @@
     "description": "Grants permission to upload OpenTelemetry spans to AWS X-Ray",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "logs:LogGeneratingResourceArns"
+    ],
     "dependentActions": []
   },
   "putspansforindexing": {
@@ -352,7 +354,9 @@
     "description": "Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches",
     "accessLevel": "Write",
     "resourceTypes": [],
-    "conditionKeys": [],
+    "conditionKeys": [
+      "logs:LogGeneratingResourceArns"
+    ],
     "dependentActions": []
   },
   "starttraceretrieval": {

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/conditionKeys/bedrock-agentcore.json

@@ -19,6 +19,31 @@
     "description": "Filters access by the authorizerType attribute on a Gateway",
     "type": "String"
   },
+  "bedrock-agentcore:inboundjwtclaim/aud": {
+    "key": "bedrock-agentcore:InboundJwtClaim/aud",
+    "description": "Filters access by the audience claim (aud) in the JWT passed in the request",
+    "type": "ArrayOfString"
+  },
+  "bedrock-agentcore:inboundjwtclaim/client_id": {
+    "key": "bedrock-agentcore:InboundJwtClaim/client_id",
+    "description": "Filters access by the client_id claim in the JWT passed in the request",
+    "type": "String"
+  },
+  "bedrock-agentcore:inboundjwtclaim/iss": {
+    "key": "bedrock-agentcore:InboundJwtClaim/iss",
+    "description": "Filters access by the issuer (iss) claim present in the JWT passed in the request",
+    "type": "String"
+  },
+  "bedrock-agentcore:inboundjwtclaim/scope": {
+    "key": "bedrock-agentcore:InboundJwtClaim/scope",
+    "description": "Filters access by the scope claim in the JWT passed in the request",
+    "type": "ArrayOfString"
+  },
+  "bedrock-agentcore:inboundjwtclaim/sub": {
+    "key": "bedrock-agentcore:InboundJwtClaim/sub",
+    "description": "Filters access by the subject claim (sub) in the JWT passed in the request",
+    "type": "String"
+  },
   "bedrock-agentcore:actorid": {
     "key": "bedrock-agentcore:actorId",
     "description": "Filters access by Actor Id",
@@ -38,5 +63,10 @@
     "key": "bedrock-agentcore:strategyId",
     "description": "Filters access by Memory Strategy Id",
     "type": "String"
+  },
+  "bedrock-agentcore:userid": {
+    "key": "bedrock-agentcore:userid",
+    "description": "Filters access by the static user ID value passed in the request",
+    "type": "String"
   }
 }

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/conditionKeys/xray.json

@@ -14,6 +14,11 @@
     "description": "Filters access by the tag keys that are passed in the request",
     "type": "ArrayOfString"
   },
+  "logs:loggeneratingresourcearns": {
+    "key": "logs:LogGeneratingResourceArns",
+    "description": "Filters access by LogGeneratingResourceArn in the request",
+    "type": "ArrayOfARN"
+  },
   "xray:resourcepolicyname": {
     "key": "xray:ResourcePolicyName",
     "description": "Filters access by PolicyName in the request",

iamdata-0.1.202510151/iamdata/data/metadata.json

@@ -0,0 +1,4 @@
+{
+  "version": "0.1.202510151",
+  "updatedAt": "2025-10-15T04:46:57.870Z"
+}

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/iamdata/data/resourceTypes/bedrock-agentcore.json

@@ -15,15 +15,24 @@
   },
   "workload-identity": {
     "key": "workload-identity",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}/workload-identity/${WorkloadIdentityName}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}/workload-identity/${WorkloadIdentityName}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "oauth2credentialprovider": {
     "key": "oauth2credentialprovider",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/oauth2credentialprovider/${Name}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/oauth2credentialprovider/${Name}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "apikeycredentialprovider": {
     "key": "apikeycredentialprovider",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/apikeycredentialprovider/${Name}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/apikeycredentialprovider/${Name}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "runtime": {
     "key": "runtime",
@@ -63,10 +72,16 @@
   },
   "workload-identity-directory": {
     "key": "workload-identity-directory",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   },
   "token-vault": {
     "key": "token-vault",
-    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}"
+    "arn": "arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}",
+    "conditionKeys": [
+      "aws:ResourceTag/${TagKey}"
+    ]
   }
 }

{iamdata-0.1.202510131 → iamdata-0.1.202510151}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "iamdata"
-version = "0.1.202510131"
+version = "0.1.202510151"
 authors = [
   { name="David Kerber", email="dave@cloudcopilot.io" },
 ]

iamdata-0.1.202510131/iamdata/data/metadata.json

@@ -1,4 +0,0 @@
-{
-  "version": "0.1.202510131",
-  "updatedAt": "2025-10-13T04:47:53.932Z"
-}