Merge pull request #2079 from udondan/iam-updates

Author: udondan

CHANGELOG/v0.784.0.md

@@ -0,0 +1,11 @@
+**New services:**
+
+- application-signals-mcp
+
+**New actions:**
+
+- cloudwatch:CallWithBearerToken
+- securityhub:GenerateRecommendedPolicyV2
+- securityhub:GetRecommendedPolicyV2
+- securityhub:GetUsageV2
+- securityhub:ListAccountUsageV2

README.md

@@ -15,10 +15,10 @@
 <!-- stats -->
 Support for:
 
-- 448 Services
-- 20740 Actions
-- 2208 Resource Types
-- 2336 Condition keys
+- 449 Services
+- 20747 Actions
+- 2209 Resource Types
+- 2337 Condition keys
 <!-- /stats -->
 
 ![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**

VERSION

@@ -1 +1 @@
-0.783.0
+0.784.0

docs/source/conf.py

@@ -24,7 +24,7 @@
 author = 'Daniel Schroeder'
 
 # The full version, including alpha/beta/rc tags
-release = '0.783.0'
+release = '0.784.0'
 
 # -- General configuration ---------------------------------------------------
 

docs/source/index.rst

@@ -30,10 +30,10 @@ AWS IAM policy statement generator with fluent interface.
 
 Support for:
 
-- 448 Services
-- 20740 Actions
-- 2208 Resource Types
-- 2336 Condition keys
+- 449 Services
+- 20747 Actions
+- 2209 Resource Types
+- 2337 Condition keys
 
 ..
    /stats

lib/generated/index.ts

@@ -22,6 +22,7 @@ export { Cloudsearch } from './policy-statements/cloudsearch';
 export { Cloudwatch } from './policy-statements/cloudwatch';
 export { Applicationinsights } from './policy-statements/cloudwatchapplicationinsights';
 export { ApplicationSignals } from './policy-statements/cloudwatchapplicationsignals';
+export { ApplicationSignalsMcp } from './policy-statements/cloudwatchapplicationsignalsmcpserver';
 export { Evidently } from './policy-statements/cloudwatchevidently';
 export { Internetmonitor } from './policy-statements/cloudwatchinternetmonitor';
 export { Logs } from './policy-statements/cloudwatchlogs';

lib/generated/policy-statements/cloudwatch.ts

@@ -40,6 +40,17 @@ export class Cloudwatch extends PolicyStatement {
     return this.to('BatchGetServiceLevelObjectiveBudgetReport');
   }
 
+  /**
+   * Grants permission to make API calls to CloudWatch using bearer token authentication
+   *
+   * Access Level: Write
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/permissions-reference-cw.html
+   */
+  public toCallWithBearerToken() {
+    return this.to('CallWithBearerToken');
+  }
+
   /**
    * Grants permission to create a service level objective
    *
@@ -569,6 +580,10 @@ export class Cloudwatch extends PolicyStatement {
    *
    * Access Level: Write
    *
+   * Possible conditions:
+   * - .ifAwsRequestTag()
+   * - .ifAwsTagKeys()
+   *
    * https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutDashboard.html
    */
   public toPutDashboard() {
@@ -774,6 +789,7 @@ export class Cloudwatch extends PolicyStatement {
       'ListManagedInsightRules'
     ],
     Write: [
+      'CallWithBearerToken',
       'CreateServiceLevelObjective',
       'DeleteAlarmMuteRule',
       'DeleteAlarms',
@@ -862,6 +878,9 @@ export class Cloudwatch extends PolicyStatement {
    * @param dashboardName - Identifier for the dashboardName.
    * @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
    * @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
+   *
+   * Possible conditions:
+   * - .ifAwsResourceTag()
    */
   public onDashboard(dashboardName: string, account?: string, partition?: string) {
     return this.on(`arn:${ partition ?? this.defaultPartition }:cloudwatch::${ account ?? this.defaultAccount }:dashboard/${ dashboardName }`);
@@ -946,6 +965,7 @@ export class Cloudwatch extends PolicyStatement {
    * - .toListManagedInsightRules()
    * - .toPutAlarmMuteRule()
    * - .toPutCompositeAlarm()
+   * - .toPutDashboard()
    * - .toPutInsightRule()
    * - .toPutManagedInsightRules()
    * - .toPutMetricAlarm()
@@ -968,6 +988,7 @@ export class Cloudwatch extends PolicyStatement {
    * Applies to resource types:
    * - alarm
    * - alarm-mute-rule
+   * - dashboard
    * - insight-rule
    * - metric-stream
    * - slo
@@ -991,6 +1012,7 @@ export class Cloudwatch extends PolicyStatement {
    * - .toListManagedInsightRules()
    * - .toPutAlarmMuteRule()
    * - .toPutCompositeAlarm()
+   * - .toPutDashboard()
    * - .toPutInsightRule()
    * - .toPutManagedInsightRules()
    * - .toPutMetricAlarm()

lib/generated/policy-statements/cloudwatchapplicationsignalsmcpserver.ts

@@ -0,0 +1,82 @@
+import { AccessLevelList } from '../../shared/access-level';
+import { PolicyStatement, Operator } from '../../shared';
+
+/**
+ * Statement provider for service [application-signals-mcp](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchapplicationsignalsmcpserver.html).
+ *
+ * @param sid [SID](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html) of the statement
+ */
+export class ApplicationSignalsMcp extends PolicyStatement {
+  public servicePrefix = 'application-signals-mcp';
+
+  /**
+   * Statement provider for service [application-signals-mcp](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchapplicationsignalsmcpserver.html).
+   *
+   * @param sid [SID](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html) of the statement
+   */
+  constructor(sid?: string) {
+    super(sid);
+  }
+
+  /**
+   * Grants permission to invoke read-only Application Signals MCP tools (list_monitored_services, get_service_detail, query_service_metrics, list_service_operations, get_slo, list_slos, search_transaction_spans, query_sampled_traces, list_slis, get_enablement_guide, list_change_events, list_group_services, audit_group_health, get_group_dependencies, get_group_changes, list_grouping_attribute_definitions, audit_services, audit_slos, audit_service_operations, analyze_canary_failures)
+   *
+   * Access Level: Read
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals.html
+   */
+  public toCallReadOnlyTool() {
+    return this.to('CallReadOnlyTool');
+  }
+
+  /**
+   * Grants permission to connect to and interact with the Application Signals MCP server (initialize, list tools, list resources, list prompts)
+   *
+   * Access Level: Read
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals.html
+   */
+  public toInvokeMcp() {
+    return this.to('InvokeMcp');
+  }
+
+  protected accessLevelList: AccessLevelList = {
+    Read: [
+      'CallReadOnlyTool',
+      'InvokeMcp'
+    ]
+  };
+
+  /**
+   * Adds a resource of type mcp-server to the statement
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Application-Signals.html
+   *
+   * @param resourceName - Identifier for the resourceName.
+   * @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
+   * @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
+   * @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
+   *
+   * Possible conditions:
+   * - .ifAwsResourceTag()
+   */
+  public onMcpServer(resourceName: string, account?: string, region?: string, partition?: string) {
+    return this.on(`arn:${ partition ?? this.defaultPartition }:application-signals-mcp:${ region ?? this.defaultRegion }:${ account ?? this.defaultAccount }:mcp-server/${ resourceName }`);
+  }
+
+  /**
+   * Filters access by tag key-value pairs attached to the resource
+   *
+   * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag
+   *
+   * Applies to resource types:
+   * - mcp-server
+   *
+   * @param tagKey The tag key to check
+   * @param value The value(s) to check
+   * @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
+   */
+  public ifAwsResourceTag(tagKey: string, value: string | string[], operator?: Operator | string) {
+    return this.if(`aws:ResourceTag/${ tagKey }`, value, operator ?? 'StringLike');
+  }
+}

lib/generated/policy-statements/devopsagentservice.ts

@@ -795,7 +795,7 @@ export class Aidevops extends PolicyStatement {
    * @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
    */
   public onAssociations(agentSpaceId: string, associationId: string, account?: string, region?: string, partition?: string) {
-    return this.on(`arn:${ partition ?? this.defaultPartition }:aidevops:${ region ?? this.defaultRegion }:${ account ?? this.defaultAccount }:agentspace/${ agentSpaceId }/associations/${ associationId }`);
+    return this.on(`arn:${ partition ?? this.defaultPartition }:aidevops:${ region ?? this.defaultRegion }:${ account ?? this.defaultAccount }:agentspace/${ agentSpaceId }/association/${ associationId }`);
   }
 
   /**

lib/generated/policy-statements/redshift.ts

@@ -93,7 +93,7 @@ export class Redshift extends PolicyStatement {
   }
 
   /**
-   * Grants permission to Amazon Redshift to continuously validate that the target data warehouse can receive data replicated from the source ARN
+   * Grants permission to Amazon Redshift to continuously validate that the target namespace can receive data replicated from the source ARN
    *
    * Access Level: Write
    *
@@ -369,7 +369,7 @@ export class Redshift extends PolicyStatement {
   }
 
   /**
-   * Grants permission to the source principal to create an inbound integration for data to be replicated from the source into the target data warehouse
+   * Grants permission to the source principal to create an integration into the namespace of target data warehouse
    *
    * Access Level: Write
    *