Merge pull request #1897 from udondan/iam-updates

Author: udondan

CHANGELOG/v0.752.0.md

@@ -0,0 +1,49 @@
+**New services:**
+
+- inspector2-telemetry
+
+**New actions:**
+
+- bedrock-mantle:CancelFineTuningJob
+- bedrock-mantle:CreateFile
+- bedrock-mantle:CreateFineTuningJob
+- bedrock-mantle:DeleteFile
+- bedrock-mantle:GetFile
+- bedrock-mantle:GetFineTuningJob
+- bedrock-mantle:ListFiles
+- bedrock-mantle:ListFineTuningJobs
+- bedrock:CopyBlueprintStage
+- bedrock:GetBlueprintOptimizationStatus
+- bedrock:InvokeBlueprintOptimizationAsync
+- connect:AssociateQueueEmailAddresses
+- connect:CreateNotification
+- connect:DeleteNotification
+- connect:DescribeNotification
+- connect:DisassociateQueueEmailAddresses
+- connect:ListNotifications
+- connect:ListQueueEmailAddresses
+- connect:ListUserNotifications
+- connect:SearchNotifications
+- connect:UpdateNotificationContent
+- connect:UpdateUserNotificationStatus
+- glue:DeleteIntegrationResourceProperty
+- glue:ListIntegrationResourceProperties
+- inspector2-telemetry:NotifyHeartbeat
+- inspector2-telemetry:SendTelemetry
+- inspector2-telemetry:StartSession
+- inspector2-telemetry:StopSession
+- logs:CallWithBearerToken
+- logs:PutBearerTokenAuthentication
+- payment-cryptography:GenerateAs2805KekValidation
+
+**New resource types:**
+
+- bedrock:blueprint-optimization-invocation
+- connect:notification
+- glue:integrationResourceProperty
+
+**New condition keys:**
+
+- bedrock-mantle:Files
+- bedrock-mantle:FineTuningJob
+- workmail:ImpersonationRoleId

README.md

@@ -16,8 +16,8 @@
 Support for:
 
 - 442 Services
-- 20295 Actions
-- 2149 Resource Types
+- 20311 Actions
+- 2151 Resource Types
 - 2273 Condition keys
 <!-- /stats -->
 

VERSION

@@ -1 +1 @@
-0.751.0
+0.752.0

docs/source/conf.py

@@ -24,7 +24,7 @@
 author = 'Daniel Schroeder'
 
 # The full version, including alpha/beta/rc tags
-release = '0.751.0'
+release = '0.752.0'
 
 # -- General configuration ---------------------------------------------------
 

docs/source/index.rst

@@ -31,8 +31,8 @@ AWS IAM policy statement generator with fluent interface.
 Support for:
 
 - 442 Services
-- 20295 Actions
-- 2149 Resource Types
+- 20311 Actions
+- 2151 Resource Types
 - 2273 Condition keys
 
 ..

lib/generated/policy-statements/bedrock.ts

@@ -112,6 +112,17 @@ export class Bedrock extends PolicyStatement {
     return this.to('CancelAutomatedReasoningPolicyBuildWorkflow');
   }
 
+  /**
+   * Grants permission to copy a blueprint from one stage to another
+   *
+   * Access Level: Write
+   *
+   * https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Data_Automation_for_Amazon_Bedrock.html
+   */
+  public toCopyBlueprintStage() {
+    return this.to('CopyBlueprintStage');
+  }
+
   /**
    * Grants permission to count the number of tokens in an input prompt
    *
@@ -1174,6 +1185,17 @@ export class Bedrock extends PolicyStatement {
     return this.to('GetBlueprint');
   }
 
+  /**
+   * Grants permission to get the status of a blueprint optimization job
+   *
+   * Access Level: Read
+   *
+   * https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Data_Automation_for_Amazon_Bedrock.html
+   */
+  public toGetBlueprintOptimizationStatus() {
+    return this.to('GetBlueprintOptimizationStatus');
+  }
+
   /**
    * Grants permission to retrieve blueprint recommendation
    *
@@ -1579,6 +1601,21 @@ export class Bedrock extends PolicyStatement {
     return this.to('InvokeAutomatedReasoningPolicy');
   }
 
+  /**
+   * Grants permission to invoke an async job to perform blueprint optimization
+   *
+   * Access Level: Write
+   *
+   * Possible conditions:
+   * - .ifAwsRequestTag()
+   * - .ifAwsTagKeys()
+   *
+   * https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Data_Automation_for_Amazon_Bedrock.html
+   */
+  public toInvokeBlueprintOptimizationAsync() {
+    return this.to('InvokeBlueprintOptimizationAsync');
+  }
+
   /**
    * Grants permission to invoke blueprint recommendations asynchronously
    *
@@ -2721,6 +2758,7 @@ export class Bedrock extends PolicyStatement {
       'GetAutomatedReasoningPolicyTestCase',
       'GetAutomatedReasoningPolicyTestResult',
       'GetBlueprint',
+      'GetBlueprintOptimizationStatus',
       'GetBlueprintRecommendation',
       'GetCustomModel',
       'GetCustomModelDeployment',
@@ -2775,6 +2813,7 @@ export class Bedrock extends PolicyStatement {
       'AssociateThirdPartyKnowledgeBase',
       'BatchDeleteEvaluationJob',
       'CancelAutomatedReasoningPolicyBuildWorkflow',
+      'CopyBlueprintStage',
       'CreateAgent',
       'CreateAgentActionGroup',
       'CreateAgentAlias',
@@ -2844,6 +2883,7 @@ export class Bedrock extends PolicyStatement {
       'DisassociateAgentKnowledgeBase',
       'EndSession',
       'IngestKnowledgeBaseDocuments',
+      'InvokeBlueprintOptimizationAsync',
       'InvokeBlueprintRecommendationAsync',
       'InvokeBuilder',
       'InvokeDataAutomation',
@@ -3448,6 +3488,23 @@ export class Bedrock extends PolicyStatement {
     return this.on(`arn:${ partition ?? this.defaultPartition }:bedrock:${ region ?? this.defaultRegion }:${ account ?? this.defaultAccount }:blueprint/${ blueprintId }`);
   }
 
+  /**
+   * Adds a resource of type blueprint-optimization-invocation to the statement
+   *
+   * https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Data_Automation_for_Amazon_Bedrock.html
+   *
+   * @param resourceId - Identifier for the resourceId.
+   * @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
+   * @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
+   * @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
+   *
+   * Possible conditions:
+   * - .ifAwsResourceTag()
+   */
+  public onBlueprintOptimizationInvocation(resourceId: string, account?: string, region?: string, partition?: string) {
+    return this.on(`arn:${ partition ?? this.defaultPartition }:bedrock:${ region ?? this.defaultRegion }:${ account ?? this.defaultAccount }:blueprint-optimization-invocation/${ resourceId }`);
+  }
+
   /**
    * Adds a resource of type data-automation-invocation-job to the statement
    *
@@ -3544,6 +3601,7 @@ export class Bedrock extends PolicyStatement {
    * - .toCreatePromptVersion()
    * - .toCreateProvisionedModelThroughput()
    * - .toCreateSession()
+   * - .toInvokeBlueprintOptimizationAsync()
    * - .toInvokeDataAutomationAsync()
    * - .toInvokeModel()
    * - .toPutResourcePolicy()
@@ -3587,6 +3645,7 @@ export class Bedrock extends PolicyStatement {
    * - imported-model
    * - data-automation-project
    * - blueprint
+   * - blueprint-optimization-invocation
    * - data-automation-invocation-job
    * - session
    * - custom-model-deployment
@@ -3630,6 +3689,7 @@ export class Bedrock extends PolicyStatement {
    * - .toCreatePromptVersion()
    * - .toCreateProvisionedModelThroughput()
    * - .toCreateSession()
+   * - .toInvokeBlueprintOptimizationAsync()
    * - .toInvokeDataAutomationAsync()
    * - .toInvokeModel()
    * - .toPutResourcePolicy()

lib/generated/policy-statements/cloudwatchlogs.ts

@@ -40,6 +40,17 @@ export class Logs extends PolicyStatement {
     return this.to('AssociateSourceToS3TableIntegration');
   }
 
+  /**
+   * Grants permission to authenticate requests using bearer token
+   *
+   * Access Level: Write
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html
+   */
+  public toCallWithBearerToken() {
+    return this.to('CallWithBearerToken');
+  }
+
   /**
    * Grants permission to cancel an export task if it is in PENDING or RUNNING state
    *
@@ -991,6 +1002,17 @@ export class Logs extends PolicyStatement {
     return this.to('PutAccountPolicy');
   }
 
+  /**
+   * Grants permission to enable or disable bearer token based authentication for the specified log group
+   *
+   * Access Level: Write
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutBearerTokenAuthentication.html
+   */
+  public toPutBearerTokenAuthentication() {
+    return this.to('PutBearerTokenAuthentication');
+  }
+
   /**
    * Grants permission to attach a data protection policy to detect and redact sensitive information from log events
    *
@@ -1396,6 +1418,7 @@ export class Logs extends PolicyStatement {
     Write: [
       'AssociateKmsKey',
       'AssociateSourceToS3TableIntegration',
+      'CallWithBearerToken',
       'CancelExportTask',
       'CancelImportTask',
       'CreateDelivery',
@@ -1432,6 +1455,7 @@ export class Logs extends PolicyStatement {
       'Link',
       'ProcessWithPipeline',
       'PutAccountPolicy',
+      'PutBearerTokenAuthentication',
       'PutDataProtectionPolicy',
       'PutDeliveryDestination',
       'PutDeliveryDestinationPolicy',