@cloud-copilot/iam-data

{ "allowvendedlogdeliveryforresource": { "name": "AllowVendedLogDeliveryForResource", "isPermissionOnly": true, "description": "Grants permission to configure vended telemetry for a resource", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "connectbrowserautomationstream": { "name": "ConnectBrowserAutomationStream", "description": "Grants permission to connect to a browser automation stream", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "connectbrowserliveviewstream": { "name": "ConnectBrowserLiveViewStream", "description": "Grants permission to connect to a browser live view stream", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createagentruntime": { "name": "CreateAgentRuntime", "description": "Grants permission to create a new agent runtime", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "createagentruntimeendpoint": { "name": "CreateAgentRuntimeEndpoint", "description": "Grants permission to create a new agent endpoint", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createapikeycredentialprovider": { "name": "CreateApiKeyCredentialProvider", "description": "Grants permission to create a new API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createbrowser": { "name": "CreateBrowser", "description": "Grants permission to create a new custom browser", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createcodeinterpreter": { "name": "CreateCodeInterpreter", "description": "Grants permission to create a new custom code interpreter", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createevent": { "name": "CreateEvent", "description": "Grants permission to create an Event", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "creategateway": { "name": "CreateGateway", "description": "Grants permission to create a new gateway", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "creategatewaytarget": { "name": "CreateGatewayTarget", "description": "Grants permission to create a new target in an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "creatememory": { "name": "CreateMemory", "description": "Grants permission to create a Memory resource", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "createoauth2credentialprovider": { "name": "CreateOauth2CredentialProvider", "description": "Grants permission to create a new Credential Provider to access external resources with OAuth2 protocol", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createworkloadidentity": { "name": "CreateWorkloadIdentity", "description": "Grants permission to create a new Workload Identity", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "deleteagentruntime": { "name": "DeleteAgentRuntime", "description": "Grants permission to delete an agent runtime", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteagentruntimeendpoint": { "name": "DeleteAgentRuntimeEndpoint", "description": "Grants permission to delete an agent endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteapikeycredentialprovider": { "name": "DeleteApiKeyCredentialProvider", "description": "Grants permission to delete a registered API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "deletebrowser": { "name": "DeleteBrowser", "description": "Grants permission to delete a custom browser", "accessLevel": "Write", "resourceTypes": [ { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletecodeinterpreter": { "name": "DeleteCodeInterpreter", "description": "Grants permission to delete a custom code interpreter", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteevent": { "name": "DeleteEvent", "description": "Grants permission to delete an Event", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "deletegateway": { "name": "DeleteGateway", "description": "Grants permission to delete an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletegatewaytarget": { "name": "DeleteGatewayTarget", "description": "Grants permission to delete an existing gateway target", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletememory": { "name": "DeleteMemory", "description": "Grants permission to delete a Memory resource", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletememoryrecord": { "name": "DeleteMemoryRecord", "description": "Grants permission to delete a Memory Record", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteoauth2credentialprovider": { "name": "DeleteOauth2CredentialProvider", "description": "Grants permission to delete a registered OAuth2 Credential Provider", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "deleteworkloadidentity": { "name": "DeleteWorkloadIdentity", "description": "Grants permission to delete a registered Workload Identity", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getagentruntime": { "name": "GetAgentRuntime", "description": "Grants permission to get details of an agent runtime", "accessLevel": "Read", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getagentruntimeendpoint": { "name": "GetAgentRuntimeEndpoint", "description": "Grants permission to get details of an agent endpoint", "accessLevel": "Read", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getapikeycredentialprovider": { "name": "GetApiKeyCredentialProvider", "description": "Grants permission to fetch a registered API Key Credential Provider by its name", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getbrowser": { "name": "GetBrowser", "description": "Grants permission to get details of a browser", "accessLevel": "Read", "resourceTypes": [ { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getbrowsersession": { "name": "GetBrowserSession", "description": "Grants permission to get details of a browser session", "accessLevel": "Read", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getcodeinterpreter": { "name": "GetCodeInterpreter", "description": "Grants permission to get details of a code interpreter", "accessLevel": "Read", "resourceTypes": [ { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getcodeinterpretersession": { "name": "GetCodeInterpreterSession", "description": "Grants permission to get details of a code interpreter session", "accessLevel": "Read", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getevent": { "name": "GetEvent", "description": "Grants permission to fetch an Event", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "getgateway": { "name": "GetGateway", "description": "Grants permission to retrieve an existing gateway", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getgatewaytarget": { "name": "GetGatewayTarget", "description": "Grants permission to retrieve an existing gateway target", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getmemory": { "name": "GetMemory", "description": "Grants permission to fetch details for a Memory resource", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getmemoryrecord": { "name": "GetMemoryRecord", "description": "Grants permission to fetch a Memory Record", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getoauth2credentialprovider": { "name": "GetOauth2CredentialProvider", "description": "Grants permission to fetch a registered OAuth2 Credential Provider by its name", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getresourceapikey": { "name": "GetResourceApiKey", "description": "Grants permission to retrieve an API Key associated with an Api Key Credential Provider", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getresourceoauth2token": { "name": "GetResourceOauth2Token", "description": "Grants permission to retrieve access token with OAuth2 2LO or 3LO flow to access external resource", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "gettokenvault": { "name": "GetTokenVault", "description": "Grants permission to fetch the current configuration of the TokenVault, including encryption settings", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getworkloadaccesstoken": { "name": "GetWorkloadAccessToken", "description": "Grants permission to retrieve an Workload access token for agentic workloads not acting on behalf of a user", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getworkloadaccesstokenforjwt": { "name": "GetWorkloadAccessTokenForJWT", "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with JWT token", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getworkloadaccesstokenforuserid": { "name": "GetWorkloadAccessTokenForUserId", "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with User Id", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "getworkloadidentity": { "name": "GetWorkloadIdentity", "description": "Grants permission to fetch details for a specific Workload identity, including its name and allowed OAuth2 return URLs", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntimeendpoint": { "name": "InvokeAgentRuntimeEndpoint", "description": "Grants permission to invoke an agent endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokecodeinterpreter": { "name": "InvokeCodeInterpreter", "description": "Grants permission to invoke a code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listactors": { "name": "ListActors", "description": "Grants permission to list Actors", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listagentruntimeendpoints": { "name": "ListAgentRuntimeEndpoints", "description": "Grants permission to list agent endpoints", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listagentruntimeversions": { "name": "ListAgentRuntimeVersions", "description": "Grants permission to list agent runtime versions", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listagentruntimes": { "name": "ListAgentRuntimes", "description": "Grants permission to list agent runtimes", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listapikeycredentialproviders": { "name": "ListApiKeyCredentialProviders", "description": "Grants permission to list all API Key Credential Providers in the Token Vault", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listbrowsersessions": { "name": "ListBrowserSessions", "description": "Grants permission to list browser sessions", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listbrowsers": { "name": "ListBrowsers", "description": "Grants permission to list browsers", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listcodeinterpretersessions": { "name": "ListCodeInterpreterSessions", "description": "Grants permission to list code interpreter sessions", "accessLevel": "List", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listcodeinterpreters": { "name": "ListCodeInterpreters", "description": "Grants permission to list code interpreters", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listevents": { "name": "ListEvents", "description": "Grants permission to list events", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "listgatewaytargets": { "name": "ListGatewayTargets", "description": "Grants permission to list existing gateway targets", "accessLevel": "List", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listgateways": { "name": "ListGateways", "description": "Grants permission to list existing gateways", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listmemories": { "name": "ListMemories", "description": "Grants permission to list memory resources", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listmemoryrecords": { "name": "ListMemoryRecords", "description": "Grants permission to list memory records", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace", "bedrock-agentcore:strategyId" ], "dependentActions": [] }, "listoauth2credentialproviders": { "name": "ListOauth2CredentialProviders", "description": "Grants permission to list all OAuth2 Credential Providers in the Token Vault", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listsessions": { "name": "ListSessions", "description": "Grants permission to list sessions", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:actorId" ], "dependentActions": [] }, "listworkloadidentities": { "name": "ListWorkloadIdentities", "description": "Grants permission to list all Workload Identities in the caller's AWS account", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "retrievememoryrecords": { "name": "RetrieveMemoryRecords", "description": "Grants permission to retrieve memory records through sematic query", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace", "bedrock-agentcore:strategyId" ], "dependentActions": [] }, "settokenvaultcmk": { "name": "SetTokenVaultCMK", "description": "Grants permission to associate a Customer Managed Key (CMK) or a Service Managed Key with a specific TokenVault", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "startbrowsersession": { "name": "StartBrowserSession", "description": "Grants permission to starts a new browser session", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "startcodeinterpretersession": { "name": "StartCodeInterpreterSession", "description": "Grants permission to start a new code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "stopbrowsersession": { "name": "StopBrowserSession", "description": "Grants permission to stop a browser session", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "stopcodeinterpretersession": { "name": "StopCodeInterpreterSession", "description": "Grants permission to stop a code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "synchronizegatewaytargets": { "name": "SynchronizeGatewayTargets", "isPermissionOnly": true, "description": "Grants permission to enable search on gateways", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateagentruntime": { "name": "UpdateAgentRuntime", "description": "Grants permission to update an agent runtime", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updateagentruntimeendpoint": { "name": "UpdateAgentRuntimeEndpoint", "description": "Grants permission to update an agent endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateapikeycredentialprovider": { "name": "UpdateApiKeyCredentialProvider", "description": "Grants permission to update an existing API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "updatebrowserstream": { "name": "UpdateBrowserStream", "description": "Grants permission to update the status of browser session stream", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updategateway": { "name": "UpdateGateway", "description": "Grants permission to update an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updategatewaytarget": { "name": "UpdateGatewayTarget", "description": "Grants permission to update an existing gateway target", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updatememory": { "name": "UpdateMemory", "description": "Grants permission to update a Memory resource", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updateoauth2credentialprovider": { "name": "UpdateOauth2CredentialProvider", "description": "Grants permission to update an existing OAuth2 Credential Provider", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "updateworkloadidentity": { "name": "UpdateWorkloadIdentity", "description": "Grants permission to update the metadata of an existing Workload Identity", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] } }