@cloud-copilot/iam-data/data/actions/securitylake.json

AWS IAM Data

{
  "createawslogsource": {
    "name": "CreateAwsLogSource",
    "description": "Grants permission to enable any source type in any region for accounts that are either part of a trusted organization or standalone account",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createcustomlogsource": {
    "name": "CreateCustomLogSource",
    "description": "Grants permission to add a custom source",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createdatalake": {
    "name": "CreateDataLake",
    "description": "Grants permission to create a new security data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:ResourceTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "createdatalakeexceptionsubscription": {
    "name": "CreateDataLakeExceptionSubscription",
    "description": "Grants permission to get instant notifications about exceptions. Subscribes to the SNS topics for exception notifications",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createdatalakeorganizationconfiguration": {
    "name": "CreateDataLakeOrganizationConfiguration",
    "description": "Grants permission to automatically enable Amazon Security Lake for new member accounts in your organization",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createsubscriber": {
    "name": "CreateSubscriber",
    "description": "Grants permission to create a subscriber",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:ResourceTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "createsubscribernotification": {
    "name": "CreateSubscriberNotification",
    "description": "Grants permission to create a webhook invocation to notify a client when there is new data in the data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deleteawslogsource": {
    "name": "DeleteAwsLogSource",
    "description": "Grants permission to disable any source type in any region for accounts that are part of a trusted organization or standalone accounts",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletecustomlogsource": {
    "name": "DeleteCustomLogSource",
    "description": "Grants permission to remove a custom source",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletedatalake": {
    "name": "DeleteDataLake",
    "description": "Grants permission to delete security data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletedatalakeexceptionsubscription": {
    "name": "DeleteDataLakeExceptionSubscription",
    "description": "Grants permission to unsubscribe from SNS topics for exception notifications. Removes exception notifications for the SNS topic",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletedatalakeorganizationconfiguration": {
    "name": "DeleteDataLakeOrganizationConfiguration",
    "description": "Grants permission to remove the automatic enablement of Amazon Security Lake access for new organization accounts",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletesubscriber": {
    "name": "DeleteSubscriber",
    "description": "Grants permission to delete the specified subscriber",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletesubscribernotification": {
    "name": "DeleteSubscriberNotification",
    "description": "Grants permission to remove a webhook invocation to notify a client when there is new data in the data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deregisterdatalakedelegatedadministrator": {
    "name": "DeregisterDataLakeDelegatedAdministrator",
    "description": "Grants permission to remove the Delegated Administrator account and disable Amazon Security Lake as a service for this organization",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getdatalakeexceptionsubscription": {
    "name": "GetDataLakeExceptionSubscription",
    "description": "Grants permission to query the protocol and endpoint that were provided when subscribing to SNS topics for exception notifications",
    "accessLevel": "Read",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getdatalakeorganizationconfiguration": {
    "name": "GetDataLakeOrganizationConfiguration",
    "description": "Grants permission to get an organization's configuration setting for automatically enabling Amazon Security Lake access for new organization accounts",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getdatalakesources": {
    "name": "GetDataLakeSources",
    "description": "Grants permission to get a static snapshot of the security data lake in the current region. The snapshot includes enabled accounts and log sources",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getsubscriber": {
    "name": "GetSubscriber",
    "description": "Grants permission to get information about subscriber that is already created",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listdatalakeexceptions": {
    "name": "ListDataLakeExceptions",
    "description": "Grants permission to get the list of all non-retryable failures",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listdatalakes": {
    "name": "ListDataLakes",
    "description": "Grants permission to list information about the security data lakes",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listlogsources": {
    "name": "ListLogSources",
    "description": "Grants permission to view the enabled accounts. You can view the enabled sources in the enabled regions",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listsubscribers": {
    "name": "ListSubscribers",
    "description": "Grants permission to list all subscribers",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listtagsforresource": {
    "name": "ListTagsForResource",
    "description": "Grants permission to list all tags for the resource",
    "accessLevel": "List",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "subscriber",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "registerdatalakedelegatedadministrator": {
    "name": "RegisterDataLakeDelegatedAdministrator",
    "description": "Grants permission to designate an account as the Amazon Security Lake administrator account for the organization",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "tagresource": {
    "name": "TagResource",
    "description": "Grants permission to add tags to the resource",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "subscriber",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "untagresource": {
    "name": "UntagResource",
    "description": "Grants permission to remove tags from the resource",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "subscriber",
        "required": false,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "updatedatalake": {
    "name": "UpdateDataLake",
    "description": "Grants permission to update a security data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "data-lake",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "updatedatalakeexceptionsubscription": {
    "name": "UpdateDataLakeExceptionSubscription",
    "description": "Grants permission to update subscriptions to the SNS topics for exception notifications",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "updatesubscriber": {
    "name": "UpdateSubscriber",
    "description": "Grants permission to update subscriber",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "updatesubscribernotification": {
    "name": "UpdateSubscriberNotification",
    "description": "Grants permission to update a webhook invocation to notify a client when there is new data in the data lake",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "subscriber",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  }
}